Restriction of filesystem mounting

Dave Hansen dave at linux.vnet.ibm.com
Tue Sep 15 13:42:40 PDT 2009


On Tue, 2009-09-15 at 23:35 +0300, Sergey Kononenko wrote:
> I've come across the need to restrict ability of mounting filesystems
> inside container and probably forbid remounting of already mounted
> filesystems in container namespace (mounted by lxc-start for example).
> It semms that the obvious solution is to drop capability from bounding
> set of processes inside container. Unfortunately there is no separate
> capability for mount/umount and dropping of CAP_SYS_ADMIN is
> unacceptable in my case.

Could you explain a little more why you have this requirement?  Anybody
in their own filesystem namespace can do no harm to users in other
namespaces.  What's the worry?

-- Dave



More information about the Containers mailing list