Re: [PATCH][CFT] per-process namespaces for Linux

From: Alexander Viro (
Date: Mon Feb 26 2001 - 07:51:25 EST

On Mon, 26 Feb 2001, Marco d'Itri wrote:

> On Feb 26, Alexander Viro <> wrote:
> >There is no way to implement them without credentials' cache. Which needs
> >to be done for many other reasons, but that's a separate patch and
> >separate story. If it's done - no serious penalty involved. However,
> >I doubt that we want a union on / itself. /dev - sure, /bin and /lib -
> >maybe, but /... What for?
> What I'd really like to do is remount / somewhere with mount --bind,
> mount over it another skeleton file system which hides setuid programs
> and some directories and then run a chrooted sshd in the new root.
> If I'm not missing something, this would make creation of secure chroot
> environments very easy.

I'm making NOSUID per-mountpoint. So
        pid = clone(CLONE_NEWNS,0);
        if (!pid) {
                remount everything with nosuid
                exec sshd
should be OK
As for hiding the directories - also easy, mount --bind an empty
immutable directory over each of them.

NODEV is also easy to make per-mountpoint, but readonly may be trickier;
we need permission() to take vfsmount+dentry instead of inode for that.
Doable, but will touch quite a few places.

To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to
More majordomo info at
Please read the FAQ at

This archive was generated by hypermail 2b29 : Wed Feb 28 2001 - 21:00:11 EST