Re: [PATCH] devpts: Add ptmx_uid and ptmx_gid options

[Andy Lutomirski <luto amacapital net>]

On Tue, Mar 31, 2015 at 12:57 AM, Alexander Larsson <alexl redhat com> wrote:
> On fre, 2015-03-27 at 10:03 +0100, James Bottomley
> > > On Fri, Feb 20, 2015 at 5:04 PM, Andy Lutomirski <luto amacapital net> wrote:
> > > > It's currently impossible to mount devpts in a user namespace that
> > > > has no root user, since ptmx can't be created.
> >
> > This is where I stopped reading because it's not true ... because it is
> > possible, you just do it from the host as real root.
>
> The point is being able to set up a container as a user, not requiring
> the setup to be run as root at all. In my case container is a desktop
> application which will be started by the user, and will run as the user.
> There is no root involved in the call chain at all.

Even more precisely, I think the status quo has less to do with the
privilege of the userns' creator and more to do with the configuration
of the userns.  Anyone (root or otherwise) can create a userns with or
without a "root" inside.  With the current code, if you create a
userns with no inner root, you can't mount devpts inside.

This gives no security benefit exactly because nonroot users *can*
create user namespaces that contain a root user.  In the use case for
this patch, the user doesn't want to do that and then gets stuck with
the current code.


--Andy


> --
> =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
>  Alexander Larsson                                            Red Hat, Inc
>        alexl redhat com            alexander larsson gmail com
> He's a war-weary Catholic boxer for the 21st century. She's a beautiful
> renegade magician's assistant looking for love in all the wrong places.
> They fight crime!



-- 
Andy Lutomirski
AMA Capital Management, LLC