From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755190AbcEDXaV (ORCPT ); Wed, 4 May 2016 19:30:21 -0400 Received: from youngberry.canonical.com ([91.189.89.112]:48248 "EHLO youngberry.canonical.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753952AbcEDXaU (ORCPT ); Wed, 4 May 2016 19:30:20 -0400 Date: Wed, 4 May 2016 23:30:09 +0000 From: Serge Hallyn To: Djalal Harouni Cc: Alexander Viro , Chris Mason , tytso@mit.edu, Serge Hallyn , Josh Triplett , "Eric W. Biederman" , Andy Lutomirski , Seth Forshee , linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org, linux-security-module@vger.kernel.org, Dongsu Park , David Herrmann , Miklos Szeredi , Alban Crequy Subject: Re: [RFC v2 PATCH 0/8] VFS:userns: support portable root filesystems Message-ID: <20160504233009.GB17801@ubuntumail> References: <1462372014-3786-1-git-send-email-tixxdz@gmail.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <1462372014-3786-1-git-send-email-tixxdz@gmail.com> User-Agent: Mutt/1.5.21 (2010-09-15) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Quoting Djalal Harouni (tixxdz@gmail.com): > This is version 2 of the VFS:userns support portable root filesystems > RFC. Changes since version 1: > > * Update documentation and remove some ambiguity about the feature. > Based on Josh Triplett comments. > * Use a new email address to send the RFC :-) > > > This RFC tries to explore how to support filesystem operations inside > user namespace using only VFS and a per mount namespace solution. This > allows to take advantage of user namespace separations without > introducing any change at the filesystems level. All this is handled > with the virtual view of mount namespaces. Given your use case, is there any way we could work in some tradeoffs to protect the host? What I'm thinking is that containers can all share devices uid-mapped at will, however any device mounted with uid shifting cannot be used by the inital user namespace. Or maybe just non-executable in that case, as you'll need enough access to the fs to set up the containers you want to run. So if /dev/sda1 is your host /, you have to use /dev/sda2 as the container rootfs source. Mount it under /containers with uid shifting. Now all containers regardless of uid mappings see the shifted fs contents. But the host root cannot be tricked by files on it, as /dev/sda2 is non-executable as far as it is concerned. Just a thought.