Home » Mailing lists » Devel » [patch 0/8] mount ownership and unprivileged mount syscall (v4)
Re: [patch 2/8] allow unprivileged umount [message #18450 is a reply to message #18408] |
Sun, 22 April 2007 07:09 ![Go to previous message Go to previous message](/theme/ovz3/images/up.png) ![Go to next message Go to previous message](/theme/ovz3/images/down.png) |
ebiederm
Messages: 1354 Registered: February 2006
|
Senior Member |
|
|
Miklos Szeredi <miklos@szeredi.hu> writes:
> Does this mean, that containers will need this? Or that you don't
> know yet?
The uid namespace is something we have to handle carefully and we
have not decided on the final design.
What is clear is that all permission checks will need to become
either (uid namspace, uid) tuple comparisons. Or struct user
pointer comparisons. To see if we are talking about the same
uid.
So the eventual uid namespace combined with the possibility
for rlimits if we use struct user *. See to make using a struct
user a clear win.
>> storing a user struct on each mount point seems sane, plus it allows
>> per user mount rlimits which is major plus. Especially since we
>> seem to be doing accounting only for user mounts a per user rlimit
>> seems good.
>
> I'm not against per-user rlimits for mounts, but I'd rather do this
> later...
Then let's add a non-discriminate limit. Instead of a limit that
applies only to root.
>> To get the user we should be user fs_uid as HPA suggested.
>
> fsuid is exclusively used for checking file permissions, which we
> don't do here anymore. So while it could be argued, that mount() _is_
> a filesystem operation, it is really a different sort of filesystem
> operation than the rest.
>
> OTOH it wouldn't hurt to use fsuid instead of ruid...
Yes. I may be confused but I'm pretty certain we want either
the fsuid or the euid to be the mount owner. ruid just looks wrong.
The fsuid is a special case of the effective uid. Which is who
we should perform operations as. Unless I'm just confused.
>> Finally I'm pretty certain the capability we should care about in
>> this context is CAP_SETUID. Instead of CAP_SYS_ADMIN.
>>
>> If we have CAP_SETUID we can become which ever user owns the mount,
>> and the root user in a container needs this, so he can run login
>> programs. So changing the appropriate super user checks from
>> CAP_SYS_ADMIN to CAP_SETUID I think is the right thing todo.
>
> That's a flawed logic. If you want to mount as a specific user, and
> you have CAP_SETUID, then just use set*uid() and then mount().
Totally agreed for mount.
> Changing the capability check for mount() would break the userspace
> ABI.
Sorry I apparently wasn't clear. CAP_SETUID should be the capability
check for umount.
Hopefully my other more detail replies helped with this.
Eric
_______________________________________________
Containers mailing list
Containers@lists.linux-foundation.org
https://lists.linux-foundation.org/mailman/listinfo/containers
|
|
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
[patch 0/8] mount ownership and unprivileged mount syscall (v4)
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
[patch 1/8] add user mounts to the kernel
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch 1/8] add user mounts to the kernel
By: akpm on Sat, 21 April 2007 07:55
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch 1/8] add user mounts to the kernel
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch 1/8] add user mounts to the kernel
By: ebiederm on Sat, 21 April 2007 13:14
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch 1/8] add user mounts to the kernel
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch 1/8] add user mounts to the kernel
By: ebiederm on Sun, 22 April 2007 07:43
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch 1/8] add user mounts to the kernel
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch 1/8] add user mounts to the kernel
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
[patch 2/8] allow unprivileged umount
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch 2/8] allow unprivileged umount
By: akpm on Sat, 21 April 2007 07:55
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch 2/8] allow unprivileged umount
By: hpa on Sat, 21 April 2007 08:01
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch 2/8] allow unprivileged umount
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch 2/8] allow unprivileged umount
By: akpm on Sat, 21 April 2007 08:36
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch 2/8] allow unprivileged umount
By: ebiederm on Sat, 21 April 2007 12:53
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch 2/8] allow unprivileged umount
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch 2/8] allow unprivileged umount
By: ebiederm on Sat, 21 April 2007 13:29
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch 2/8] allow unprivileged umount
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch 2/8] allow unprivileged umount
By: ebiederm on Sun, 22 April 2007 07:09
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch 2/8] allow unprivileged umount
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
[patch 3/8] account user mounts
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch 3/8] account user mounts
By: akpm on Sat, 21 April 2007 07:55
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch 3/8] account user mounts
By: ebiederm on Sat, 21 April 2007 13:37
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch 3/8] account user mounts
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch 3/8] account user mounts
By: ebiederm on Sun, 22 April 2007 07:49
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch 3/8] account user mounts
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
[patch 4/8] propagate error values from clone_mnt
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch 4/8] propagate error values from clone_mnt
By: ebiederm on Sat, 21 April 2007 13:40
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
[patch 5/8] allow unprivileged bind mounts
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch 5/8] allow unprivileged bind mounts
By: ebiederm on Sat, 21 April 2007 14:00
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch 5/8] allow unprivileged bind mounts
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
[patch 6/8] put declaration of put_filesystem() in fs.h
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
[patch 7/8] allow unprivileged mounts
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch 7/8] allow unprivileged mounts
By: akpm on Sat, 21 April 2007 07:55
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch 7/8] allow unprivileged mounts
By: ebiederm on Sat, 21 April 2007 14:10
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch 7/8] allow unprivileged mounts
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch 7/8] allow unprivileged mounts
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch 7/8] allow unprivileged mounts
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch 7/8] allow unprivileged mounts
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch 7/8] allow unprivileged mounts
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch 7/8] allow unprivileged mounts
By: ebiederm on Sat, 21 April 2007 16:57
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch 7/8] allow unprivileged mounts
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch 7/8] allow unprivileged mounts
By: ebiederm on Sat, 21 April 2007 21:00
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch 7/8] allow unprivileged mounts
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch 7/8] allow unprivileged mounts
By: ebiederm on Sat, 21 April 2007 21:33
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
[patch 8/8] allow unprivileged fuse mounts
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch 8/8] allow unprivileged fuse mounts
By: akpm on Sat, 21 April 2007 07:55
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch 8/8] allow unprivileged fuse mounts
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch 8/8] allow unprivileged fuse mounts
By: ebiederm on Sat, 21 April 2007 14:18
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch 8/8] allow unprivileged fuse mounts
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch 0/8] mount ownership and unprivileged mount syscall (v4)
By: ebiederm on Wed, 25 April 2007 01:04
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch 0/8] mount ownership and unprivileged mount syscall (v4)
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch 0/8] mount ownership and unprivileged mount syscall (v4)
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch 0/8] mount ownership and unprivileged mount syscall (v4)
|
Goto Forum:
Current Time: Wed Aug 14 22:43:37 GMT 2024
Total time taken to generate the page: 0.02755 seconds
|