From: Konstantin Khorenko <khorenko@virtuozzo.com>
To: Vasileios Almpanis <vasileios.almpanis@virtuozzo.com>,
Mirian Shilakadze <mirian.shilakadze@virtuozzo.com>
Cc: devel@openvz.org
Subject: Re: [Devel] [PATCH vz10 0/3] ve/fs: make mount ownership follow the mount namespace
Date: Wed, 26 Aug 2026 17:30:01 +0200 [thread overview]
Message-ID: <2bf3c330-a553-428d-8a6d-46e3cf9cc8ae@virtuozzo.com> (raw)
In-Reply-To: <178704961442.266722.6134525770095478679.b4-review@b4>
On 8/18/26 12:40, Vasileios Almpanis wrote:
>>
> Generally LGTM. The only problematic scenario I see now that we gate
> host execution based on namespace is that we could have tmpfs with two
> mounts one in host and one in CT. CT can still tamper with things and on
> the fs and ve_check_trusted_file will still return true allowing us to
> execute on host. I don't thing this should be covered in this series as its
> irrelevant I just wanted to mention it in case other reviewers think we
> need to do something about it. If deemed necessary we could solve it
> in O(1) time, by using some superblock flag and checking against that
> in ve_check_trusted_file.
Absolutely agree, so we need to handle this scenario as well,
i have filed a separate bug for that:
https://virtuozzo.atlassian.net/browse/VSTOR-142982
_______________________________________________
Devel mailing list
Devel@openvz.org
https://lists.openvz.org/mailman/listinfo/devel
prev parent reply other threads:[~2026-08-26 15:31 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-08-17 7:16 Mirian Shilakadze
2026-08-17 7:16 ` [Devel] [PATCH vz10 1/3] ve/fs: unlink the mount namespace on the copy_mnt_ns() error path Mirian Shilakadze
2026-08-26 15:38 ` [Devel] [PATCH RHEL10 COMMIT] " Konstantin Khorenko
2026-08-17 7:16 ` [Devel] [PATCH vz10 2/3] ve/fs: transfer mount ownership when a mount enters another VE Mirian Shilakadze
2026-08-26 15:38 ` [Devel] [PATCH RHEL10 COMMIT] " Konstantin Khorenko
2026-08-17 7:16 ` [Devel] [PATCH vz10 3/3] ve/fs: take the owner of copied mounts from the namespace, not the task Mirian Shilakadze
2026-08-26 15:38 ` [Devel] [PATCH RHEL10 COMMIT] " Konstantin Khorenko
2026-08-18 10:40 ` [Devel] [PATCH vz10 0/3] ve/fs: make mount ownership follow the mount namespace Vasileios Almpanis
2026-08-26 15:30 ` Konstantin Khorenko [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=2bf3c330-a553-428d-8a6d-46e3cf9cc8ae@virtuozzo.com \
--to=khorenko@virtuozzo.com \
--cc=devel@openvz.org \
--cc=mirian.shilakadze@virtuozzo.com \
--cc=vasileios.almpanis@virtuozzo.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.