On Wed, Apr 20, 2005 at 10:45:58 +0100, Jamie Lokier wrote: > Al Viro wrote: > > Most of the code is already there - do_fork() has to do such stuff anyway. > > So how about adding sys_unshare(flags) that would do that job? Flags would > > correspond to those of clone(2), except that all these guys would be > > "what do we unshare" instead of "what do we leave shared". > > That would let a program split off into its own namespace, but that's > not really what's needed for FUSE. > > For FUSE, what's needed is that a user can mount something, and the > mounted fs is visible only to that user, but it's visible to _all_ of > the user's processes.
Including root's su to that user...
Keeping information in a process group is the *only* way to actually
lock out root. That is, except some kind of keyring in kernel.
-------------------------------------------------------------------------------
Jan 'Bulb' Hudec <[EMAIL
PROTECTED]>
signature.asc
Description: Digital signature
