[Devel] Re: Restriction of filesystem mounting

[Dave Hansen]

On Tue, 2009-09-15 at 23:35 +0300, Sergey Kononenko wrote:
> I've come across the need to restrict ability of mounting filesystems
> inside container and probably forbid remounting of already mounted
> filesystems in container namespace (mounted by lxc-start for example).
> It semms that the obvious solution is to drop capability from bounding
> set of processes inside container. Unfortunately there is no separate
> capability for mount/umount and dropping of CAP_SYS_ADMIN is
> unacceptable in my case.

Could you explain a little more why you have this requirement?  Anybody
in their own filesystem namespace can do no harm to users in other
namespaces.  What's the worry?

-- Dave

_______________________________________________
Containers mailing list
Containers at lists.linux-foundation.org
https://lists.linux-foundation.org/mailman/listinfo/containers