[REVIEW][PATCH] vfs: Lock in place mounts from more privileged users

Eric W. Biederman ebiederm at xmission.com
Wed Jul 24 16:05:36 UTC 2013

"Serge E. Hallyn" <serge at hallyn.com> writes:

> Quoting Serge E. Hallyn (serge at hallyn.com):
>> Quoting Eric W. Biederman (ebiederm at xmission.com):
>> > 
>> > Serge does this patch break lxc?  I think all should be well but I want
>> > to make certain there is not some hidden case where this fundamentaly
>> > breaks some functionality.
>> I haven't yet tried.  I'll build and test a kernel today.  I'm pretty
>> sure all the child's mounts are done after clone, so I *think* the worst
>> case will be that the unmounting of put_old after pivot_root() will
>> be noisy.  Will let you know.
>> -serge
> Just tested it - works fine.  Warns about all of the failed umounts.

Just to confirm.  Can you do a lazy umount of put_old and get rid of

> Acked-by: Serge Hallyn <serge.hallyn at canonical.com>
> ( Mind you I'm not approving of the idea of hiding mounts as a security
> mechanisms, but I know that neither are you :)

As a security mechanism, not really.  This is more about closing a
theoretical hole in case someone was sloppy, and doing it before user
namespaces are too widely deployed so we avoid massive user space
breakage.  It let's me sleep more soundly at night if I know you can't
more access more with user namespaces that you can without user


More information about the Containers mailing list