News for hackers. Stuff that matters.
Re:Escaping Docker container using waitid() – CVE-2017-5123 by ecnahc515 on Friday December 29, 2017 @05:47PM (#16032552)
I recall seeing some patches submitted to make it possible to pass an uid/gid offset to the mount syscall at one point when people were implementing usernamespaces for container runtimes like docker. So is this fixable without having to make every file system implement this feature, or is there something else holding back better support for doing uid shifting for use with user namespaces?
Re:Escaping Docker container using waitid() – CVE-2017-5123 by cpuguy83 on Friday December 29, 2017 @05:52PM (#16032566)
That has not been accepted into the kernel. It's called "shiftfs", which basically let's you perform the uid/gid shift on mount.