OpenVZ Forum - RDF feed
type: channel
items: [patch 1/9] unprivileged mounts: add user mounts to the kernel
items: Re: [patch 1/9] unprivileged mounts: add user mounts to the kernel

[patch 1/9] unprivileged mounts: add user mounts to the kernel
type: item
description: From: Miklos Szeredi <mszeredi@suse.cz> This patchset adds support for keeping mount ownership information in the kernel, and allow unprivileged mount(2) and umount(2) in certain cases. The mount owner has the following privileges: - unmount the owned mount - create a submount under the owned mount The sysadmin can set the owner explicitly on mount and remount. When an unprivileged user creates a mount, then the owner is automatically set to the user. The following use cases are envisioned: 1) Private namespace, with selected mounts owned by user. E.g. /home/$USER is a good candidate for allowing unpriv mounts and unmounts within. 2) Private namespace, with all mounts owned by user and having the "nosuid" flag. User can mount and umount anywhere within the namespace, but suid programs will not work. 3) Global namespace, with a designated directory, which is a mount owned by the user. E.g. /mnt/users/$USER is set up so that it is bind mounted onto itself, and set to be owned by $USER. The user can add/remove mounts only under this directory. The following extra security measures are taken for unprivileged mounts: - usermounts are limited by a sysctl tunable - force "nosuid,nodev" mount options on the created mount For testing unprivileged mounts (and for other purposes) simple mount/umount utilities are available from: http://www.kernel.org/pub/linux/kernel/people/mszeredi/mmount/ After this series I'll be posting a preliminary patch for util-linux-ng, to add the same functionality to mount(8) and umount(8). This patch: A new mount flag, MS_SETUSER is used to make a mount owned by a user. If this flag is specified, then the owner will be set to the current fsuid and the mount will be marked with the MNT_USER flag. On remount don't preserve previous owner, and treat MS_SETUSER as for a new mount. The MS_SETUSER flag is ignored on mount move. The MNT_USER flag is not copied on any kind of mount cloning: namespace creation, binding or propagation. For bind mounts the cl…
creator: Miklos Szeredi
date: 2008-01-08T11:35:03-00:00

Re: [patch 1/9] unprivileged mounts: add user mounts to the kernel
type: item
description: On Tue 2008-01-08 12:35:03, Miklos Szeredi wrote: > From: Miklos Szeredi <mszeredi@suse.cz> > > This patchset adds support for keeping mount ownership information in the > kernel, and allow unprivileged mount(2) and umount(2) in certain cases. > > The mount owner has the following privileges: > > - unmount the owned mount > - create a submount under the owned mount - create unkillable processes - block suspend/hibernation ? Pavel -- (english) http://www.livejournal.com/~pavelmachek (cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html _______________________________________________ Containers mailing list Containers@lists.linux-foundation.org https://lists.linux-foundation.org/mailman/listinfo/containers
creator: Pavel Machek
date: 2008-01-08T21:34:21-00:00

Re: [patch 1/9] unprivileged mounts: add user mounts to the kernel
type: item
description: On Tue 2008-01-08 12:35:03, Miklos Szeredi wrote: > From: Miklos Szeredi <mszeredi@suse.cz> > > This patchset adds support for keeping mount ownership information in the > kernel, and allow unprivileged mount(2) and umount(2) in certain cases. > > The mount owner has the following privileges: > > - unmount the owned mount > - create a submount under the owned mount - create traps for updatedb, etc? Is there Doc* file somewhere describing dangers of allowing this? Pavel -- (english) http://www.livejournal.com/~pavelmachek (cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html _______________________________________________ Containers mailing list Containers@lists.linux-foundation.org https://lists.linux-foundation.org/mailman/listinfo/containers
creator: Pavel Machek
date: 2008-01-08T21:47:22-00:00

Re: [patch 1/9] unprivileged mounts: add user mounts to the kernel
type: item
description: Quoting Miklos Szeredi (miklos@szeredi.hu): > From: Miklos Szeredi <mszeredi@suse.cz> > > This patchset adds support for keeping mount ownership information in the > kernel, and allow unprivileged mount(2) and umount(2) in certain cases. > > The mount owner has the following privileges: > > - unmount the owned mount > - create a submount under the owned mount > > The sysadmin can set the owner explicitly on mount and remount. When an > unprivileged user creates a mount, then the owner is automatically set to the > user. > > The following use cases are envisioned: > > 1) Private namespace, with selected mounts owned by user. E.g. > /home/$USER is a good candidate for allowing unpriv mounts and unmounts > within. > > 2) Private namespace, with all mounts owned by user and having the "nosuid" > flag. User can mount and umount anywhere within the namespace, but suid > programs will not work. > > 3) Global namespace, with a designated directory, which is a mount owned by > the user. E.g. /mnt/users/$USER is set up so that it is bind mounted onto > itself, and set to be owned by $USER. The user can add/remove mounts only > under this directory. > > The following extra security measures are taken for unprivileged mounts: > > - usermounts are limited by a sysctl tunable > - force "nosuid,nodev" mount options on the created mount > > For testing unprivileged mounts (and for other purposes) simple > mount/umount utilities are available from: > > http://www.kernel.org/pub/linux/kernel/people/mszeredi/mmount/ > > After this series I'll be posting a preliminary patch for util-linux-ng, > to add the same functionality to mount(8) and umount(8). > > This patch: > > A new mount flag, MS_SETUSER is used to make a mount owned by a user. If this > flag is specified, then the owner will be set to the current fsuid and the > mount will be marked with the MNT_USER flag. On remount don't preserve > previous owner, and treat MS_SETUSER as for a new mount. The MS_SETUSER flag > is ignored o…
creator: serue
date: 2008-01-14T21:46:24-00:00