Date: Sun, 5 Jun 2011 23:40:52 +0400 From: Solar Designer <solar@...nwall.com> To: kernel-hardening@...ts.openwall.com Subject: Re: procfs mount options On Sun, Jun 05, 2011 at 11:17:47PM +0400, Vasiliy Kulikov wrote: > On Sun, Jun 05, 2011 at 00:59 +0400, Solar Designer wrote: > > Here's a related thought: if these mount options happen to affect all > > instances of the filesystem (in the same container), maybe they should > > be sysctl's instead? > > AFAIR, only net namespaces have their own sysctl sets. Other sysctls > are global. So, implementing pid_namespace-specific sysctl would be a > bit weird (according to current policies). Here's what we have immediate need for, in practice: We need to be able to mount /proc with different permission settings in different OpenVZ containers (perhaps running different distros, which have their different defaults - e.g., Owl will use the restricted proc options by default, but other distros mostly won't). Since recent versions of OpenVZ build upon the namespaces code that has been upstream'ed, I guess this will rely on upstream's namespaces code (once we move to RHEL6'ish OpenVZ kernels and beyond), correct? Now, leaving sysctl's aside and speaking of mount options only for now, what happens when a container mounts /proc with umask=007, but then another container mounts /proc without that option or with umask=0? Does the first container retain its restricted perms, including for newly appearing entries under its /proc? If so, where is this different setting stored? Is it per mount (preferable)? Is it per pid namespace (OK)? Or per net namespace (weird)? Thanks, Alexander
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.