Re: [patch 0/8] unprivileged mount syscall

> Arn't there ways to escape chroot jails? Serge had pointed me to a URL
> which showed chroots can be escaped. And if that is true than having all
> user's private mount tree in the same namespace can be a security issue?

No.  In fact chrooting the user into /share/$USER will actually
_grant_ a privilege to the user, instead of taking it away.  It allows
the user to modify it's root namespace, which it wouldn't be able to
in the initial namespace.

So even if the user could escape from the chroot (which I doubt), s/he
would not be able to do any harm, since unprivileged mounting would be
restricted to /share.  Also /share/$USER should only have read/search
permission for $USER or no permissions at all, which would mean, that
other users' namespaces would be safe from tampering as well.

Miklos
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to [email protected]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

---

• Follow-Ups:
  • Re: [patch 0/8] unprivileged mount syscall
    • From: [email protected] (Eric W. Biederman)

• References:
  • Re: [patch 0/8] unprivileged mount syscall
    • From: Andrew Morton <[email protected]>
  • Re: [patch 0/8] unprivileged mount syscall
    • From: Miklos Szeredi <[email protected]>
  • Re: [patch 0/8] unprivileged mount syscall
    • From: "Serge E. Hallyn" <[email protected]>
  • Re: [patch 0/8] unprivileged mount syscall
    • From: Miklos Szeredi <[email protected]>
  • Re: [patch 0/8] unprivileged mount syscall
    • From: "Serge E. Hallyn" <[email protected]>
  • Re: [patch 0/8] unprivileged mount syscall
    • From: Miklos Szeredi <[email protected]>
  • Re: [patch 0/8] unprivileged mount syscall
    • From: Ram Pai <[email protected]>
  • Re: [patch 0/8] unprivileged mount syscall
    • From: Miklos Szeredi <[email protected]>
  • Re: [patch 0/8] unprivileged mount syscall
    • From: Ram Pai <[email protected]>
  • Re: [patch 0/8] unprivileged mount syscall
    • From: Miklos Szeredi <[email protected]>
  • Re: [patch 0/8] unprivileged mount syscall
    • From: "Serge E. Hallyn" <[email protected]>
  • Re: [patch 0/8] unprivileged mount syscall
    • From: Miklos Szeredi <[email protected]>
  • Re: [patch 0/8] unprivileged mount syscall
    • From: Ram Pai <[email protected]>

• Prev by Date: Re: [Announce] [patch] Modular Scheduler Core and Completely Fair Scheduler [CFS]
• Next by Date: Re: [2/2] 2.6.21-rc7: known regressions
• Previous by thread: Re: [patch 0/8] unprivileged mount syscall
• Next by thread: Re: [patch 0/8] unprivileged mount syscall
• Index(es):
  • Date
  • Thread

[Index of Archives]     [Kernel Newbies]     [Netfilter]     [Bugtraq]     [Photo]     [Stuff]     [Gimp]     [Yosemite News]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux RAID]     [Video 4 Linux]     [Linux for the blind]     [Linux Resources]