Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1185463

Re: [PATCH 0/7] Initial support for user namespace owned mounts

Show all headers | View raw

Seth I think for the LSMs we should start with:

diff --git a/security/security.c b/security/security.c
index 062f3c997fdc..5b6ece92a8e5 100644
--- a/security/security.c
+++ b/security/security.c
@@ -310,6 +310,8 @@ int security_sb_statfs(struct dentry *dentry)
 int security_sb_mount(const char *dev_name, struct path *path,
                        const char *type, unsigned long flags, void *data)
 {
+       if (current_user_ns() != &init_user_ns)
+               return -EPERM;
        return call_int_hook(sb_mount, 0, dev_name, path, type, flags, data);
 }


Then we should push this down into all of the lsms.
Then when we should remove or relax or change the check as appropriate
in each lsm.

The point is this is good enough to see that it is trivially safe,
and this allows us to focus on the core issues, and stop worrying about
the lsms for a bit.

Then we can focus on each lsm one at at time and take the time to really
understand them and talk with their maintainers etc to make certain
we get things correct.

This should remove the need for your patches 5, 6 and 7. For the
immediate future.

Eric
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Back to linux.kernel | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

Re: [PATCH 0/7] Initial support for user namespace owned mounts ebiederm@xmission.com (Eric W. Biederman) - 2015-07-16 05:30 +0200
  Re: [PATCH 0/7] Initial support for user namespace owned mounts Casey Schaufler <casey@schaufler-ca.com> - 2015-07-16 17:10 +0200
    Re: [PATCH 0/7] Initial support for user namespace owned mounts Seth Forshee <seth.forshee@canonical.com> - 2015-07-16 21:00 +0200
      Re: [PATCH 0/7] Initial support for user namespace owned mounts Casey Schaufler <casey@schaufler-ca.com> - 2015-07-16 23:50 +0200
        Re: [PATCH 0/7] Initial support for user namespace owned mounts Andy Lutomirski <luto@amacapital.net> - 2015-07-17 00:30 +0200
          Re: [PATCH 0/7] Initial support for user namespace owned mounts Casey Schaufler <casey@schaufler-ca.com> - 2015-07-17 01:10 +0200
            Re: [PATCH 0/7] Initial support for user namespace owned mounts Andy Lutomirski <luto@amacapital.net> - 2015-07-17 01:40 +0200
              Re: [PATCH 0/7] Initial support for user namespace owned mounts Casey Schaufler <casey@schaufler-ca.com> - 2015-07-17 02:50 +0200
                Re: [PATCH 0/7] Initial support for user namespace owned mounts Andy Lutomirski <luto@amacapital.net> - 2015-07-17 03:00 +0200
                Re: [PATCH 0/7] Initial support for user namespace owned mounts "Serge E. Hallyn" <serge@hallyn.com> - 2015-07-17 16:30 +0200
                Re: [PATCH 0/7] Initial support for user namespace owned mounts Seth Forshee <seth.forshee@canonical.com> - 2015-07-17 17:00 +0200
        Re: [PATCH 0/7] Initial support for user namespace owned mounts Seth Forshee <seth.forshee@canonical.com> - 2015-07-17 15:30 +0200
  Re: [PATCH 0/7] Initial support for user namespace owned mounts Seth Forshee <seth.forshee@canonical.com> - 2015-07-16 18:10 +0200

csiph-web