On Wed, Nov 18, 2015 at 02:58:18PM +0000, Al Viro wrote:

On Wed, Nov 18, 2015 at 08:22:38AM -0600, Seth Forshee wrote:

quoted

But it still requires the admin set it up that way, no? And aren't
privileges required to set up those devices in the first place?

I'm not saying that it wouldn't be a good idea to lock down the backing
stores for those types of devices too, just that it isn't something that
a regular user could exploit without an admin doing something to
facilitate it.

Sigh...  If it boils down to "all admins within all containers must be
trusted not to try and break out" (along with "roothole in any container
escalates to kernel-mode code execution on host"), then what the fuck
is the *point* of bothering with containers, userns, etc. in the first
place?  If your model is basically "you want isolation, just use kvm",
fine, but where's the place for userns in all that?

And if you are talking about the _host_ admin, then WTF not have him just
mount what's needed as part of setup and to hell with mounting those
inside the container?

Yes, the host admin. I'm not talking about trusting the admin inside the
container at all.

From my perspective the idea is essentially to allow mounting with fuse
or with ext4 using "mount -o loop ..." within a container.