Groups > linux.kernel > #1196150

Re: [PATCH 0/7] Initial support for user namespace owned mounts

From	Colin Walters <walters@verbum.org>
Newsgroups	linux.kernel
Subject	Re: [PATCH 0/7] Initial support for user namespace owned mounts
Date	2015-07-30 18:00 +0200
Message-ID	<pRYpr-2RD-7@gated-at.bofh.it> (permalink)
References	<pRNDH-4hT-3@gated-at.bofh.it> <pRWxj-ap-5@gated-at.bofh.it> <pRXjH-1kU-3@gated-at.bofh.it> <pRY66-2v3-33@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

It's worth noting here that I think a lot of the use cases
for unprivileged mounts are testing/development type things,
and these are pretty well covered by:

http://libguestfs.org/

Basically it just runs the host kernel in a VM, and the userspace
is a minimal agent that you can talk to over virtio.  You can use
the API, or `guestmount` exposes it via FUSE.

It doesn't magically make the kernel filesystems robust against
untrusted input, but in the case of compromise, it's an
"unprivileged" VM.  I've used it for several projects and been
quite happy.

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Thread

Re: [PATCH 0/7] Initial support for user namespace owned mounts Amir Goldstein <amir@cellrox.com> - 2015-07-30 06:30 +0200
  Re: [PATCH 0/7] Initial support for user namespace owned mounts Amir Goldstein <amir@cellrox.com> - 2015-07-30 16:50 +0200
    Re: [PATCH 0/7] Initial support for user namespace owned mounts Casey Schaufler <casey@schaufler-ca.com> - 2015-07-30 17:40 +0200
      Re: [PATCH 0/7] Initial support for user namespace owned mounts Colin Walters <walters@verbum.org> - 2015-07-30 18:00 +0200
  Re: [PATCH 0/7] Initial support for user namespace owned mounts Amir Goldstein <amir@cellrox.com> - 2015-07-30 17:10 +0200

csiph-web