Restriction of filesystem mounting
dave at linux.vnet.ibm.com
Tue Sep 15 13:42:40 PDT 2009
On Tue, 2009-09-15 at 23:35 +0300, Sergey Kononenko wrote:
> I've come across the need to restrict ability of mounting filesystems
> inside container and probably forbid remounting of already mounted
> filesystems in container namespace (mounted by lxc-start for example).
> It semms that the obvious solution is to drop capability from bounding
> set of processes inside container. Unfortunately there is no separate
> capability for mount/umount and dropping of CAP_SYS_ADMIN is
> unacceptable in my case.
Could you explain a little more why you have this requirement? Anybody
in their own filesystem namespace can do no harm to users in other
namespaces. What's the worry?
More information about the Containers