Re:Escaping Docker container using waitid() – CVE-2017-5123
by ecnahc515 on Friday December 29, 2017 @05:47PM
(#16032552)
I recall seeing some patches submitted to make it possible to pass an uid/gid offset to the mount syscall at one point when people were implementing usernamespaces for container runtimes like docker. So is this fixable without having to make every file system implement this feature, or is there something else holding back better support for doing uid shifting for use with user namespaces?
[ Parent
| on HN ]