Re: Sandbox thoughts

On Thu, Feb 19, 2015 at 8:38 AM, Alexander Larsson <alexl redhat com> wrote:
On Tue, 2015-02-17 at 13:23 -0800, Andy Lutomirski wrote:

 - setuid / privileged helper.  Why do you need a privileged helper?
You should be able to do all of this using user namespaces.  The
Sandstorm code linked above does exactly this.

I tried this a bit, but i ran into two snags i don't understand.

First of all, as uid/gid 1000 i can put "1000 1000 1"
in /proc/self/uid_map from the child. However, i cannot put "1000 1000
1" into gid_map, as i get EPERM.
I don't understand this, is this not supposed to work?

You need newer manpages :-/  Try the attached variant.

Secondly, i'm failing to mount another instance of devpts. It fails with

Hmm.  Off the top of my head, there's no good reason that devpts with
the newinstance option couldn't be allowed in a userns.  Eric, any
thoughts here?  The patch would be straightforward.


Attachment: test-user.c
Description: Text Data

[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]