Re: [PATCH v5 0/4] fuse: Add support for mounts from pid/user namespaces
On Mon, Nov 3, 2014 at 9:15 AM, Seth Forshee wrote: > On Wed, Oct 22, 2014 at 04:24:16PM -0500, Seth Forshee wrote: >> Here's another update to the patches to enable userns mounts in fuse. >> The changes this time around center on xattrs and allow_other. I'm >> considering the following patch to be a prerequisite for this series: >> >> http://lkml.kernel.org/g/252a4d87d99fc2b5fe4411c838f65b312c4e13cd.1413330857.git.l...@amacapital.net >> >> With this patch I'm dropping the xattr restrictions from the v4 patches. >> This leaves the situation with xattrs unchanged in init_user_ns. A fuse >> userns mount could still supply xattrs which the user would normally be >> unable to set, but since the mount will be inaccessible outside of that >> userns or its descendants those xattrs will never be seen by the host. >> >> I'm also in agreement with Andy that some decision regarding this patch >> should be made before merging the fuse userns support as well: >> >> http://lkml.kernel.org/g/2686c32f00b14148379e8cfee9c028c794d4aa1a.1407974494.git.l...@amacapital.net >> >> Changes since v4: >> - Drop patch to restrict xattrs >> - Update allow_other to restrict based on userns of current rather than >>uid/gid > > Miklos, Eric - Any feedback from either of you on these patches? > [off-list to avoid further clutter] Eric's moving, I think, and will be mostly unavailable for a week or two. --Andy > Thanks, > Seth -- Andy Lutomirski AMA Capital Management, LLC -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Re: [PATCH v5 0/4] fuse: Add support for mounts from pid/user namespaces
On Wed, Oct 22, 2014 at 04:24:16PM -0500, Seth Forshee wrote: > Here's another update to the patches to enable userns mounts in fuse. > The changes this time around center on xattrs and allow_other. I'm > considering the following patch to be a prerequisite for this series: > > http://lkml.kernel.org/g/252a4d87d99fc2b5fe4411c838f65b312c4e13cd.1413330857.git.l...@amacapital.net > > With this patch I'm dropping the xattr restrictions from the v4 patches. > This leaves the situation with xattrs unchanged in init_user_ns. A fuse > userns mount could still supply xattrs which the user would normally be > unable to set, but since the mount will be inaccessible outside of that > userns or its descendants those xattrs will never be seen by the host. > > I'm also in agreement with Andy that some decision regarding this patch > should be made before merging the fuse userns support as well: > > http://lkml.kernel.org/g/2686c32f00b14148379e8cfee9c028c794d4aa1a.1407974494.git.l...@amacapital.net > > Changes since v4: > - Drop patch to restrict xattrs > - Update allow_other to restrict based on userns of current rather than >uid/gid Miklos, Eric - Any feedback from either of you on these patches? Thanks, Seth -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Re: [PATCH v5 0/4] fuse: Add support for mounts from pid/user namespaces
On Wed, Oct 22, 2014 at 04:24:16PM -0500, Seth Forshee wrote: Here's another update to the patches to enable userns mounts in fuse. The changes this time around center on xattrs and allow_other. I'm considering the following patch to be a prerequisite for this series: http://lkml.kernel.org/g/252a4d87d99fc2b5fe4411c838f65b312c4e13cd.1413330857.git.l...@amacapital.net With this patch I'm dropping the xattr restrictions from the v4 patches. This leaves the situation with xattrs unchanged in init_user_ns. A fuse userns mount could still supply xattrs which the user would normally be unable to set, but since the mount will be inaccessible outside of that userns or its descendants those xattrs will never be seen by the host. I'm also in agreement with Andy that some decision regarding this patch should be made before merging the fuse userns support as well: http://lkml.kernel.org/g/2686c32f00b14148379e8cfee9c028c794d4aa1a.1407974494.git.l...@amacapital.net Changes since v4: - Drop patch to restrict xattrs - Update allow_other to restrict based on userns of current rather than uid/gid Miklos, Eric - Any feedback from either of you on these patches? Thanks, Seth -- To unsubscribe from this list: send the line unsubscribe linux-kernel in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Re: [PATCH v5 0/4] fuse: Add support for mounts from pid/user namespaces
On Mon, Nov 3, 2014 at 9:15 AM, Seth Forshee seth.fors...@canonical.com wrote: On Wed, Oct 22, 2014 at 04:24:16PM -0500, Seth Forshee wrote: Here's another update to the patches to enable userns mounts in fuse. The changes this time around center on xattrs and allow_other. I'm considering the following patch to be a prerequisite for this series: http://lkml.kernel.org/g/252a4d87d99fc2b5fe4411c838f65b312c4e13cd.1413330857.git.l...@amacapital.net With this patch I'm dropping the xattr restrictions from the v4 patches. This leaves the situation with xattrs unchanged in init_user_ns. A fuse userns mount could still supply xattrs which the user would normally be unable to set, but since the mount will be inaccessible outside of that userns or its descendants those xattrs will never be seen by the host. I'm also in agreement with Andy that some decision regarding this patch should be made before merging the fuse userns support as well: http://lkml.kernel.org/g/2686c32f00b14148379e8cfee9c028c794d4aa1a.1407974494.git.l...@amacapital.net Changes since v4: - Drop patch to restrict xattrs - Update allow_other to restrict based on userns of current rather than uid/gid Miklos, Eric - Any feedback from either of you on these patches? [off-list to avoid further clutter] Eric's moving, I think, and will be mostly unavailable for a week or two. --Andy Thanks, Seth -- Andy Lutomirski AMA Capital Management, LLC -- To unsubscribe from this list: send the line unsubscribe linux-kernel in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
[PATCH v5 0/4] fuse: Add support for mounts from pid/user namespaces
Here's another update to the patches to enable userns mounts in fuse. The changes this time around center on xattrs and allow_other. I'm considering the following patch to be a prerequisite for this series: http://lkml.kernel.org/g/252a4d87d99fc2b5fe4411c838f65b312c4e13cd.1413330857.git.l...@amacapital.net With this patch I'm dropping the xattr restrictions from the v4 patches. This leaves the situation with xattrs unchanged in init_user_ns. A fuse userns mount could still supply xattrs which the user would normally be unable to set, but since the mount will be inaccessible outside of that userns or its descendants those xattrs will never be seen by the host. I'm also in agreement with Andy that some decision regarding this patch should be made before merging the fuse userns support as well: http://lkml.kernel.org/g/2686c32f00b14148379e8cfee9c028c794d4aa1a.1407974494.git.l...@amacapital.net Changes since v4: - Drop patch to restrict xattrs - Update allow_other to restrict based on userns of current rather than uid/gid Thanks, Seth Seth Forshee (4): fuse: Add support for pid namespaces fuse: Support fuse filesystems outside of init_user_ns fuse: Restrict allow_other to the superblock's namespace or a descendant fuse: Allow user namespace mounts fs/fuse/dev.c| 13 fs/fuse/dir.c| 91 +--- fs/fuse/file.c | 38 --- fs/fuse/fuse_i.h | 16 +++--- fs/fuse/inode.c | 81 ++--- 5 files changed, 171 insertions(+), 68 deletions(-) -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
[PATCH v5 0/4] fuse: Add support for mounts from pid/user namespaces
Here's another update to the patches to enable userns mounts in fuse. The changes this time around center on xattrs and allow_other. I'm considering the following patch to be a prerequisite for this series: http://lkml.kernel.org/g/252a4d87d99fc2b5fe4411c838f65b312c4e13cd.1413330857.git.l...@amacapital.net With this patch I'm dropping the xattr restrictions from the v4 patches. This leaves the situation with xattrs unchanged in init_user_ns. A fuse userns mount could still supply xattrs which the user would normally be unable to set, but since the mount will be inaccessible outside of that userns or its descendants those xattrs will never be seen by the host. I'm also in agreement with Andy that some decision regarding this patch should be made before merging the fuse userns support as well: http://lkml.kernel.org/g/2686c32f00b14148379e8cfee9c028c794d4aa1a.1407974494.git.l...@amacapital.net Changes since v4: - Drop patch to restrict xattrs - Update allow_other to restrict based on userns of current rather than uid/gid Thanks, Seth Seth Forshee (4): fuse: Add support for pid namespaces fuse: Support fuse filesystems outside of init_user_ns fuse: Restrict allow_other to the superblock's namespace or a descendant fuse: Allow user namespace mounts fs/fuse/dev.c| 13 fs/fuse/dir.c| 91 +--- fs/fuse/file.c | 38 --- fs/fuse/fuse_i.h | 16 +++--- fs/fuse/inode.c | 81 ++--- 5 files changed, 171 insertions(+), 68 deletions(-) -- To unsubscribe from this list: send the line unsubscribe linux-kernel in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
