[Devel] [PATCH vz10 0/3] ve/fs: make mount ownership follow the mount namespace

[Konstantin Khorenko]

On 8/18/26 12:40, Vasileios Almpanis wrote:

>>
> Generally LGTM. The only problematic scenario I see now that we gate
> host execution based on namespace is that we could have tmpfs with two
> mounts one in host and one in CT. CT can still tamper with things and on
> the fs and ve_check_trusted_file will still return true allowing us to
> execute on host. I don't thing this should be covered in this series as its
> irrelevant I just wanted to mention it in case other reviewers think we
> need to do something about it. If deemed necessary we could solve it
> in O(1) time, by using some superblock flag and checking against that
> in ve_check_trusted_file.

Absolutely agree, so we need to handle this scenario as well,
i have filed a separate bug for that:
https://virtuozzo.atlassian.net/browse/VSTOR-142982