Re: [CFT][PATCH 00/10] Making new mounts of proc and sysfs as safe as bind mounts (take 2)
From: Serge Hallyn <hidden>
Date: 2015-05-28 14:08:46
Also in:
linux-fsdevel
Quoting Andy Lutomirski (luto@amacapital.net):
On Fri, May 22, 2015 at 10:39 AM, Eric W. Biederman [off-list ref] wrote:quoted
I had hoped to get some Tested-By's on that patch series.Sorry, I've been totally swamped. I suspect that Sandstorm is okay, but I haven't had a chance to test it for real. Sandstorm makes only limited use of proc and sysfs in containers, but I'll see if I can test it for real this weekend.
Testing this with unprivileged containers, I get lxc-start: conf.c: lxc_mount_auto_mounts: 808 Operation not permitted - error mounting sysfs on /usr/lib/x86_64-linux-gnu/lxc/sys/devices/virtual/net flags 0
quoted
Oh well. The fundamentals seem sound, and my biggest concern the implicit nodev does not apply so I will put this patchset in linux-next and aim at merging it in the next merge window. Hopefully that will leave enough time catch problems. Eric-- Andy Lutomirski AMA Capital Management, LLC _______________________________________________ Containers mailing list Containers@lists.linux-foundation.org https://lists.linuxfoundation.org/mailman/listinfo/containers