Skip to content
This repository has been archived by the owner on Feb 24, 2020. It is now read-only.

stage1/init: create a new mount ns for each app #2603

Merged
merged 3 commits into from May 12, 2016
Merged

stage1/init: create a new mount ns for each app #2603

merged 3 commits into from May 12, 2016

Commits on May 11, 2016

  1. stage1/init: create a new mount ns for each app 

    Up to this point, you could escape the app's chroot easily by using a
simple program downloaded from the internet [[1]][1]. To avoid this, we
now create a new mount namespace per each app.

You can still escape the chroot if you have CAP_SYS_PTRACE and access
`/proc/1/root` but this fixes the issue for images that don't need this
capability.

[1]: http://www.unixwiz.net/techtips/chroot-practices.html
    @iaguis
    iaguis committed May 11, 2016
    Copy the full SHA
    de1e896 View commit details
    Browse the repository at this point in the history

  2. functional tests: test reading a file written in another app

    @iaguis
    iaguis committed May 11, 2016
    Copy the full SHA
    2b468df View commit details
    Browse the repository at this point in the history

Commits on May 12, 2016

  1. fuctional tests: check that each app is in a different mount ns

    @iaguis
    iaguis committed May 12, 2016
    Copy the full SHA
    44d1f4e View commit details
    Browse the repository at this point in the history