Lennart Poettering
d6f8e1ae87
mntfsd: add api to mount dirs for containers
...
systemd-mountfsd so far provided a MountImage() API call for mounting a
disk image and returning a set of mount fds. This complements the API
with a new MountDirectory() API call, that operates on a directory
instead of an image file. Now, what makes this interesting is that it
applies an idmapping from the foreign UID range to the provided target
userns – and in which case unpriveleged operation is allowed (well,
under some conditions: in particular the client must own a parent dir of
the provided path).
This allows container managers to run fully unprivileged from
directories – as long as those directories are owned by the foreign UID
range. Basic operation is like this:
1. acquire a transient userns from systemd-nsresourced with 64K users
2. ask systemd-mountfsd for an idmapped mount of the container dir
matching that userns
3. join the userns and bind the mount fd as root.
Note that we have to drop various sandboxing knobs from the mountfsd
service file for this to work, since the kernel's security checks that
try to ensure than an obstructed /proc/ cannot be circumvented via
mounting a new procfs will otherwise prohibit mountfsd to duplicate the
mounts properly.
2025-01-23 21:48:02 +01:00
..
2025-01-02 16:39:05 +01:00
2022-07-12 22:54:39 +01:00
2022-07-20 13:15:37 +09:00
2022-07-12 22:54:39 +01:00
2023-09-27 12:33:40 +02:00
2025-01-03 08:32:43 +01:00
2025-01-03 08:32:43 +01:00
2025-01-03 08:32:43 +01:00
2025-01-03 08:32:43 +01:00
2024-03-14 11:34:04 +01:00
2024-10-11 10:36:08 +02:00
2025-01-08 22:30:04 +01:00
2025-01-08 22:30:04 +01:00
2023-05-19 17:47:14 +02:00
2024-05-28 14:48:56 +02:00
2024-05-28 14:48:56 +02:00
2024-03-16 05:31:44 +09:00
2024-05-18 01:28:14 +09:00
2022-03-14 22:39:32 +00:00
2023-06-23 13:46:56 +01:00
2023-06-23 13:46:56 +01:00
2025-01-08 22:30:04 +01:00
2024-05-18 01:28:14 +09:00
2024-12-10 20:50:09 +01:00
2023-04-28 23:26:20 +01:00
2025-01-07 20:31:15 +09:00
2021-10-15 10:19:54 -05:00
2021-10-15 10:19:54 -05:00
2024-05-18 01:28:14 +09:00
2023-08-12 07:55:20 +09:00
2024-09-24 15:32:58 +02:00
2023-05-23 12:39:16 +02:00
2025-01-15 09:48:27 +00:00
2025-01-23 16:29:20 +01:00
2022-05-21 14:29:14 +02:00
2022-05-21 14:29:14 +02:00
2022-05-21 14:29:14 +02:00
2024-05-28 14:48:56 +02:00
2024-05-28 14:48:56 +02:00
2024-03-09 19:32:09 +00:00
2024-03-10 22:57:22 +08:00
2023-06-06 18:23:43 +01:00
2021-10-14 12:17:02 -05:00
2024-03-16 05:31:44 +09:00
2025-01-08 22:30:04 +01:00
2024-05-23 00:06:30 +09:00
2024-03-14 17:23:28 +01:00
2023-11-13 15:45:16 +01:00
2024-05-28 14:48:56 +02:00
2024-05-28 14:48:56 +02:00
2024-05-28 14:48:56 +02:00
2024-05-28 14:48:56 +02:00
2022-09-15 14:59:11 +02:00
2024-05-28 14:48:53 +02:00
2023-06-01 18:49:43 +02:00
2023-06-01 18:49:43 +02:00
2023-04-25 17:40:41 +02:00
2022-09-15 14:59:11 +02:00
2025-01-02 16:37:57 +01:00
2022-09-15 14:59:11 +02:00
2025-01-02 16:37:57 +01:00
2025-01-02 16:39:05 +01:00
2025-01-02 16:39:05 +01:00
2023-07-28 19:34:03 +01:00
2024-03-19 13:06:44 +00:00
2024-05-28 14:48:56 +02:00
2023-07-28 19:34:03 +01:00
2024-04-10 23:40:53 +08:00
2023-01-04 15:18:10 +01:00
2023-07-05 10:58:47 +09:00
2024-03-14 11:15:55 +01:00
2024-08-26 15:40:15 +02:00
2024-07-06 10:17:20 +01:00
2025-01-23 16:29:28 +01:00
2024-12-01 12:16:54 +00:00
2024-02-12 11:57:24 +01:00
2024-12-12 22:48:04 +01:00
2024-03-14 11:14:10 +01:00
2024-08-26 15:40:15 +02:00
2024-09-20 04:47:27 +09:00
2023-07-28 19:34:03 +01:00
2024-07-09 20:59:35 +02:00
2023-07-28 19:34:03 +01:00
2023-07-28 19:34:03 +01:00
2023-06-22 10:33:18 +01:00
2024-04-03 22:07:43 +08:00
2023-09-07 20:21:16 +08:00
2024-01-15 02:59:25 +08:00
2023-12-18 11:10:53 +01:00
2024-12-21 19:15:01 +01:00
2024-01-09 21:57:46 +08:00
2024-03-14 11:14:10 +01:00
2023-05-23 12:39:16 +02:00
2024-01-15 02:59:25 +08:00
2024-06-25 09:57:42 +02:00
2024-06-25 09:57:42 +02:00
2023-07-28 19:34:03 +01:00
2023-05-23 12:39:16 +02:00
2024-05-26 03:11:24 +09:00
2023-07-28 19:34:03 +01:00
2023-07-28 19:34:03 +01:00
2023-10-12 23:10:59 +01:00
2023-01-11 17:18:57 +01:00
2022-07-01 14:17:33 +09:00
2024-05-02 19:41:01 +02:00
2024-06-03 16:30:54 +01:00
2024-03-14 11:14:10 +01:00
2024-05-17 11:57:53 +09:00
2024-03-15 15:57:10 +01:00
2023-06-22 10:33:18 +01:00
2024-01-09 21:57:46 +08:00
2024-10-22 23:44:47 +02:00
2024-03-14 10:26:45 +01:00
2023-07-28 19:34:03 +01:00
2024-03-17 13:33:45 +01:00
2025-01-23 21:48:02 +01:00
2024-04-06 16:08:24 +02:00
2024-01-08 12:59:08 +01:00
2024-04-26 22:16:33 +02:00
2023-07-28 19:34:03 +01:00
2023-07-28 19:34:03 +01:00
2024-12-17 17:34:46 +01:00
2024-09-10 04:38:11 +09:00
2024-04-06 16:08:24 +02:00
2024-04-06 16:08:24 +02:00
2025-01-14 14:42:23 +01:00
2023-09-25 23:27:18 +02:00
2024-03-14 10:26:45 +01:00
2024-08-26 15:40:15 +02:00
2024-03-14 10:26:45 +01:00
2024-03-14 10:26:45 +01:00
2024-03-14 10:26:45 +01:00
2024-03-14 10:26:45 +01:00
2024-03-14 10:26:45 +01:00
2024-03-14 10:26:45 +01:00
2024-03-14 10:26:45 +01:00
2024-03-14 10:26:45 +01:00
2024-03-14 10:26:45 +01:00
2024-03-14 11:14:10 +01:00
2024-08-26 15:40:15 +02:00
2024-03-14 10:26:45 +01:00
2024-03-14 10:26:45 +01:00
2024-03-14 10:26:45 +01:00
2024-03-14 10:26:45 +01:00
2023-07-28 19:34:03 +01:00
2023-07-28 19:34:03 +01:00
2024-03-09 19:32:09 +00:00
2024-03-10 22:57:22 +08:00
2023-07-28 19:34:03 +01:00
2024-05-28 14:48:56 +02:00
2024-04-15 22:33:45 +02:00
2024-12-17 17:34:46 +01:00
2024-03-14 00:10:48 +09:00
2023-07-05 10:58:47 +09:00
2024-05-23 00:06:30 +09:00
2023-11-13 15:45:16 +01:00
2024-01-15 02:59:25 +08:00
2023-07-28 19:34:03 +01:00
2023-07-28 19:34:03 +01:00
2025-01-23 16:29:28 +01:00
2024-12-01 12:17:21 +00:00
2024-03-14 11:14:10 +01:00
2024-08-26 15:40:15 +02:00
2023-07-28 19:34:03 +01:00
2022-03-19 00:13:55 +01:00
2023-07-28 19:34:03 +01:00
2024-04-27 12:11:13 +02:00
2024-11-06 15:44:11 -05:00
2023-08-12 07:55:20 +09:00
2023-09-19 10:05:38 +02:00
2024-01-09 21:57:45 +08:00
2024-12-17 17:34:46 +01:00
2023-06-08 14:09:36 +02:00
2023-08-12 07:55:20 +09:00
2023-08-12 07:55:20 +09:00
2024-06-15 19:08:35 +02:00
2024-06-12 18:31:21 +09:00
2024-06-12 18:31:21 +09:00
2024-04-16 09:45:43 +09:00
2025-01-07 20:31:15 +09:00
2025-01-07 20:31:15 +09:00
2025-01-07 20:31:15 +09:00
2023-07-28 19:34:03 +01:00
2023-07-28 19:34:03 +01:00
2023-07-28 19:34:03 +01:00
2023-07-28 19:34:03 +01:00
2023-09-27 11:02:06 +02:00
2023-11-25 13:27:17 +01:00
2024-06-21 17:49:26 +02:00
2023-07-28 19:34:03 +01:00
2025-01-18 23:13:06 +01:00
2024-01-03 13:49:02 +01:00
2024-07-01 18:52:35 +02:00
2024-10-11 10:36:08 +02:00
2021-10-14 12:17:02 -05:00
2021-10-14 12:17:02 -05:00