>> - since uwsgi is started from some other filesystem/mount point, that >> mount point will not be unmounted, so the child will keep a reference to >> the master namespace allowing it to exploit it (although there are some >> precautions against that, still). One thing that's possible is a *read >> only* bind mount of the uwsgi executable inside the child root, and >> re-execing the child from there. > > > wow, i did not know that MS_BIND could be applied to file too. This is > very useful.
it turned out that there's no need for the uwsgi to be available in the filesystem of the new namespace at all... but if you need it anytime, for reference, this is how you make a read-only bind mount of a file (in shell, but C is similar): touch uwsgi mount --bind /home/damjan/src/uwsgi-hg/uwsgi ./uwsgi mount -o remount,ro ./uwsgi -- дамјан _______________________________________________ uWSGI mailing list [email protected] http://lists.unbit.it/cgi-bin/mailman/listinfo/uwsgi
