Re: [PATCH v3] fs: Treat foreign mounts as nosuid

2014-10-21 Thread Seth Forshee
On Tue, Oct 14, 2014 at 04:54:47PM -0700, Andy Lutomirski wrote: > If a process gets access to a mount from a different namespace user > namespace, that process should not be able to take advantage of > setuid files or selinux entrypoints from that filesystem. > Technically, trusting mounts created

Re: [PATCH v3] fs: Treat foreign mounts as nosuid

2014-10-16 Thread Serge E. Hallyn
Quoting Andy Lutomirski (l...@amacapital.net): > If a process gets access to a mount from a different namespace user > namespace, that process should not be able to take advantage of > setuid files or selinux entrypoints from that filesystem. > Technically, trusting mounts created by the same or an

[PATCH v3] fs: Treat foreign mounts as nosuid

2014-10-14 Thread Andy Lutomirski
If a process gets access to a mount from a different namespace user namespace, that process should not be able to take advantage of setuid files or selinux entrypoints from that filesystem. Technically, trusting mounts created by the same or ancestor user namespaces ought to be safe, but it's simpl