Re: [PATCH v1 1/1] fs: Allow no_new_privs tasks to call chroot(2)

2021-03-10 Thread Mickaël Salaün
On 10/03/2021 17:56, Eric W. Biederman wrote: > Mickaël Salaün writes: > >> From: Mickaël Salaün >> >> Being able to easily change root directories enable to ease some >> development workflow and can be used as a tool to strengthen >> unprivileged security sandboxes. chroot(2) is not an acces

Re: [PATCH v1 1/1] fs: Allow no_new_privs tasks to call chroot(2)

2021-03-10 Thread Eric W. Biederman
Mickaël Salaün writes: > From: Mickaël Salaün > > Being able to easily change root directories enable to ease some > development workflow and can be used as a tool to strengthen > unprivileged security sandboxes. chroot(2) is not an access-control > mechanism per se, but it can be used to limit

[PATCH v1 1/1] fs: Allow no_new_privs tasks to call chroot(2)

2021-03-10 Thread Mickaël Salaün
From: Mickaël Salaün Being able to easily change root directories enable to ease some development workflow and can be used as a tool to strengthen unprivileged security sandboxes. chroot(2) is not an access-control mechanism per se, but it can be used to limit the absolute view of the filesystem