Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.debian.bugs.dist > #1137296
| From | Simon McVittie <smcv@debian.org> |
|---|---|
| Newsgroups | linux.debian.bugs.dist |
| Subject | Bug#1030625: autopkgtest: please provide a new restriction for unprivileged unshare/userns |
| Date | 2023-02-10 16:10 +0100 |
| Message-ID | <FXDce-4SuF-31@gated-at.bofh.it> (permalink) |
| References | (1 earlier) <FXc2l-4BFA-15@gated-at.bofh.it> <FVTXP-3Haz-11@gated-at.bofh.it> <FXAo1-4QGU-1@gated-at.bofh.it> <FVTXP-3Haz-11@gated-at.bofh.it> <FXAo1-4QGU-1@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
On Fri, 10 Feb 2023 at 12:58:50 +0100, Johannes Schauer Marin Rodrigues wrote:
> So the secret of
> bind-mounting proc in a privileged docker container is to use --rbind.
I assume this is because if you have "covered up" a sensitive or dangerous
part of /proc to stop processes inside the container from poking it
(for example mounting an empty file or inaccessible device node over
/proc/sysrq-trigger), doing a non-recursive mount would "uncover" it,
which is undesirable if you want your container to be anything vaguely
resembling a security boundary.
smcv
Back to linux.debian.bugs.dist | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
Bug#1030625: autopkgtest: please provide a new restriction for unprivileged unshare/userns Helmut Grohne <helmut@subdivi.de> - 2023-02-05 21:40 +0100
Bug#1030625: autopkgtest: please provide a new restriction for unprivileged unshare/userns Johannes Schauer Marin Rodrigues <josch@debian.org> - 2023-02-06 12:00 +0100
Bug#1030625: autopkgtest: please provide a new restriction for unprivileged unshare/userns Johannes Schauer Marin Rodrigues <josch@debian.org> - 2023-02-09 11:10 +0100
Bug#1030625: autopkgtest: please provide a new restriction for unprivileged unshare/userns Johannes Schauer Marin Rodrigues <josch@debian.org> - 2023-02-10 13:10 +0100
Bug#1030625: autopkgtest: please provide a new restriction for unprivileged unshare/userns Simon McVittie <smcv@debian.org> - 2023-02-10 16:10 +0100
Bug#1030625: autopkgtest: please provide a new restriction for unprivileged unshare/userns Simon McVittie <smcv@debian.org> - 2023-02-10 16:30 +0100
csiph-web