Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1185165

Re: [PATCH 0/7] Initial support for user namespace owned mounts

Show all headers | View raw

On Wed, Jul 15, 2015 at 3:39 PM, Casey Schaufler <casey@schaufler-ca.com> wrote:
> On 7/15/2015 2:06 PM, Eric W. Biederman wrote:
>> Casey Schaufler <casey@schaufler-ca.com> writes:
>
>> The first step needs to be not trusting those labels and treating such
>> filesystems as filesystems without label support.  I hope that is Seth
>> has implemented.
>
> A filesystem with Smack labels gets mounted in a namespace. The labels
> are ignored. Instead, the filesystem defaults (potentially specified as
> mount options smackfsdef="something", but usually the floor label ("_"))
> are used, giving the user the ability to read everything and (usually)
> change nothing. This is both dangerous (unintended read access to files)
> and pointless (can't make changes).

I don't get it.

If I mount an unprivileged filesystem, then either the contents were
put there *by me*, in which case letting me access them are fine, or
(with Seth's patches and then some) I control the backing store, in
which case I can do whatever I want regardless of what LSM thinks.

So I don't see the problem.  Why would Smack or any other LSM care at
all, unless it wants to prevent me from mounting the fs in the first
place?

--Andy
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Re: [PATCH 0/7] Initial support for user namespace owned mounts Casey Schaufler <casey@schaufler-ca.com> - 2015-07-15 22:40 +0200
  Re: [PATCH 0/7] Initial support for user namespace owned mounts ebiederm@xmission.com (Eric W. Biederman) - 2015-07-15 23:20 +0200
    Re: [PATCH 0/7] Initial support for user namespace owned mounts Seth Forshee <seth.forshee@canonical.com> - 2015-07-15 23:50 +0200
      Re: [PATCH 0/7] Initial support for user namespace owned mounts Andy Lutomirski <luto@amacapital.net> - 2015-07-16 03:10 +0200
        Re: [PATCH 0/7] Initial support for user namespace owned mounts ebiederm@xmission.com (Eric W. Biederman) - 2015-07-16 04:30 +0200
    Re: [PATCH 0/7] Initial support for user namespace owned mounts Andy Lutomirski <luto@amacapital.net> - 2015-07-16 03:10 +0200
      Re: [PATCH 0/7] Initial support for user namespace owned mounts Casey Schaufler <casey@schaufler-ca.com> - 2015-07-16 05:00 +0200
        Re: [PATCH 0/7] Initial support for user namespace owned mounts Dave Chinner <david@fromorbit.com> - 2015-07-17 02:20 +0200
          Re: [PATCH 0/7] Initial support for user namespace owned mounts ebiederm@xmission.com (Eric W. Biederman) - 2015-07-17 02:50 +0200
            Re: [PATCH 0/7] Initial support for user namespace owned mounts Dave Chinner <david@fromorbit.com> - 2015-07-22 10:00 +0200
              Re: [PATCH 0/7] Initial support for user namespace owned mounts "J. Bruce Fields" <bfields@fieldses.org> - 2015-07-22 16:10 +0200
        Re: [PATCH 0/7] Initial support for user namespace owned mounts Colin Walters <walters@verbum.org> - 2015-07-20 20:00 +0200
    Re: [PATCH 0/7] Initial support for user namespace owned mounts Lukasz Pawelczyk <l.pawelczyk@samsung.com> - 2015-07-16 13:20 +0200
      Re: [PATCH 0/7] Initial support for user namespace owned mounts ebiederm@xmission.com (Eric W. Biederman) - 2015-07-17 02:20 +0200
        Re: [PATCH 0/7] Initial support for user namespace owned mounts Lukasz Pawelczyk <l.pawelczyk@samsung.com> - 2015-07-17 12:20 +0200

csiph-web