> -Original Message-
> From: Daniel P. Berrange [mailto:berra...@redhat.com]
> Sent: Monday, November 18, 2013 11:57 PM
> To: Chen Hanxiao
> Cc: libvir-list@redhat.com
> Subject: Re: [libvirt] [PATCH v2]lxc: don't mount dir if ownership couldn't be
> known
> Subject: Re: [libvirt] [PATCH v2]lxc: don't mount dir if ownership couldn't
> > be
> > known
> >
> > On Wed, Nov 13, 2013 at 04:51:43PM +0800, Chen Hanxiao wrote:
> > > From: Chen Hanxiao
> > >
> > > If we enable userns, we cou
M
>>> To: Chen Hanxiao
>>> Cc: libvir-list@redhat.com
>>> Subject: Re: [libvirt] [PATCH v2]lxc: don't mount dir if ownership couldn't
>>> be
>>> known
>>>
>>> On Wed, Nov 13, 2013 at 04:51:43PM +0800, Chen Hanxiao wrote:
>>
> Subject: Re: [libvirt] [PATCH v2]lxc: don't mount dir if ownership couldn't
> > be
> > known
> >
> > On Wed, Nov 13, 2013 at 04:51:43PM +0800, Chen Hanxiao wrote:
> > > From: Chen Hanxiao
> > >
> > > If we enable userns, we cou
> -Original Message-
> From: Daniel P. Berrange [mailto:berra...@redhat.com]
> Sent: Wednesday, November 13, 2013 6:35 PM
> To: Chen Hanxiao
> Cc: libvir-list@redhat.com
> Subject: Re: [libvirt] [PATCH v2]lxc: don't mount dir if ownership couldn't be
> kno
On Wed, Nov 13, 2013 at 04:51:43PM +0800, Chen Hanxiao wrote:
> From: Chen Hanxiao
>
> If we enable userns, we could bind mount
> some dirs from host to guest, which don't belong to
> the target mapped uid/gid.
>
> Such as we could bind mount root's dirs to guest.
> What is worse, we could even
On 11/13/2013 04:51 PM, Chen Hanxiao wrote:
> From: Chen Hanxiao
>
> If we enable userns, we could bind mount
> some dirs from host to guest, which don't belong to
> the target mapped uid/gid.
>
> Such as we could bind mount root's dirs to guest.
> What is worse, we could even modify root's file
From: Chen Hanxiao
If we enable userns, we could bind mount
some dirs from host to guest, which don't belong to
the target mapped uid/gid.
Such as we could bind mount root's dirs to guest.
What is worse, we could even modify root's files
in that bind dir inside container.
So if we couldn't know
