[REVIEW][PATCH] vfs: Lock in place mounts from more privileged users
Serge E. Hallyn
serge at hallyn.com
Wed Jul 24 15:30:18 UTC 2013
Quoting Serge E. Hallyn (serge at hallyn.com):
> Quoting Eric W. Biederman (ebiederm at xmission.com):
> > Serge does this patch break lxc? I think all should be well but I want
> > to make certain there is not some hidden case where this fundamentaly
> > breaks some functionality.
> I haven't yet tried. I'll build and test a kernel today. I'm pretty
> sure all the child's mounts are done after clone, so I *think* the worst
> case will be that the unmounting of put_old after pivot_root() will
> be noisy. Will let you know.
Just tested it - works fine. Warns about all of the failed umounts.
Acked-by: Serge Hallyn <serge.hallyn at canonical.com>
( Mind you I'm not approving of the idea of hiding mounts as a security
mechanisms, but I know that neither are you :)
More information about the Containers