> Quoting Miklos Szeredi ([EMAIL PROTECTED]): > > From: Miklos Szeredi <[EMAIL PROTECTED]> > > > > On mount propagation, let the owner of the clone be inherited from the > > parent into which it has been propagated. Also if the parent has the > > "nosuid" flag, set this flag for the child as well. > > What about nodev?
Hmm, I think the nosuid thing is meant to prevent suid mounts being introduced into a "suidless" namespace. This doesn't apply to dev mounts, which are quite safe in a suidless environment, as long as the user is not able to create devices. But that should be taken care of by capability tests. I'll update the description. Thanks, Miklos _______________________________________________ Containers mailing list [EMAIL PROTECTED] https://lists.linux-foundation.org/mailman/listinfo/containers _______________________________________________ Devel mailing list [email protected] https://openvz.org/mailman/listinfo/devel
