On Mon, 2011-07-18 at 07:31 -0500, Serge E. Hallyn wrote: > Quoting Michael H. Warfield (m...@wittsend.com): > > Unfortunately, I also still find that if there's a -o remount,ro in the > > halt/reboot script, it still sets /dev/pts to ro and that still > > propagates to the host and to the other containers triggering random > > Wow. > > Did a quick grep; is there any reason why lxc-start doesn't turn on > MS_SLAVE for the client's root? Something like: > > From 7fbc3ec940403605c53b253d8630c3f47fad154c Mon Sep 17 00:00:00 2001 > From: Serge Hallyn <serge.hal...@ubuntu.com> > Date: Mon, 18 Jul 2011 07:29:57 -0500 > Subject: [PATCH 1/1] (untested) turn container rootfs into MS_SLAVE > > Signed-off-by: Serge Hallyn <serge.hal...@ubuntu.com> > --- > src/lxc/conf.c | 5 +++++ > 1 files changed, 5 insertions(+), 0 deletions(-) > > diff --git a/src/lxc/conf.c b/src/lxc/conf.c > index 2eb598b..d36fe47 100644 > --- a/src/lxc/conf.c > +++ b/src/lxc/conf.c > @@ -732,6 +732,11 @@ static int setup_rootfs(const struct lxc_rootfs *rootfs) > return -1; > } > > + if (mount(rootfs->path, rootfs->path, "none", MS_SLAVE, 0)) { > + ERROR("failed to turn child rootfs into slave"); > + return -1; > + } > + > DEBUG("mounted '%s' on '%s'", rootfs->path, rootfs->mount); > > return 0; > -- > 1.7.4.1
> > The kernel should also prohibit, totally, the propagation of remount > The kernel doesn't know about containers, so it's up to userspace :) Acceptable and that's reasonable. But, for security and integrity reasons, it has to be the host / parent user space not the guest / child user space which can make that decision. And it has to be the default. Anything less is a security vulnerability. > -serge Regards, Mike -- Michael H. Warfield (AI4NB) | (770) 985-6132 | m...@wittsend.com /\/\|=mhw=|\/\/ | (678) 463-0932 | http://www.wittsend.com/mhw/ NIC whois: MHW9 | An optimist believes we live in the best of all PGP Key: 0x674627FF | possible worlds. A pessimist is sure of it!
signature.asc
Description: This is a digitally signed message part
------------------------------------------------------------------------------ Magic Quadrant for Content-Aware Data Loss Prevention Research study explores the data loss prevention market. Includes in-depth analysis on the changes within the DLP market, and the criteria used to evaluate the strengths and weaknesses of these DLP solutions. http://www.accelacomm.com/jaw/sfnl/114/51385063/
_______________________________________________ Lxc-users mailing list Lxc-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/lxc-users