From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-qk1-f182.google.com (mail-qk1-f182.google.com [209.85.222.182]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CD9BC30B536 for ; Sun, 14 Dec 2025 18:02:57 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.222.182 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1765735379; cv=none; b=K7L5AWgeIvHA3ks8aLpah+0Cupe4a0b8ds/3GjoqSKvpVriqeN35T0nAVUlS7P8sTW5FuRL7SFpU56/7jJHlLUXAN6uRSmsGOawhnCRfURxvLdN/vJb8kjw0hPV57K1Ki3TzkjEiNFgb/lOto+tNq+DTuvIiq+eACvPyH90M3wI= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1765735379; c=relaxed/simple; bh=IVvRulDuWrrNS9715azItbKskAH+S1PQ1xvsLxX6NH4=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=FLTuutW6hKukVu/uK79d6r1M2UubNWHUipXP/h6k8m1YyxFxaUM1tRoykwDWY30waKtyYTCeFIFEBB9lzlBptQwjfo6i9ujRSDLRK702SWCehq3fAyy+W4tk2EfDdLkBGlZkHRxSUHQbRgYxJk7ZYMS11F8mryGrl/bZKWDRgLw= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=AqsL/h3Y; arc=none smtp.client-ip=209.85.222.182 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="AqsL/h3Y" Received: by mail-qk1-f182.google.com with SMTP id af79cd13be357-8b9f73728e8so253909885a.0 for ; Sun, 14 Dec 2025 10:02:57 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1765735377; x=1766340177; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=6cy/g9evgHNFkAquxzr3d7GuxFauDlKjTyALOqssS9A=; b=AqsL/h3Y/mACwWcpSGC3kQ/JZsSkD5Rm3VEWV5p2BiWyT361MvHmbkQtY1nnFpdJlB EAS3UTzJlJWQLWENaVzkB+bSfYSvmhO+Wvg69zW1EhdUM2mgFEokIQjffnIiesOwwYfE RJfso84W6q3DKIsVG+lNDkaq3dWWTgasyWyP/tP68MYaHOEYe/8n+QHx3BMpKI+qsab1 OP/ruRvQxbsyDJD3qh81LoEQzmNb9Ch5tsHUWp2rQf6r41SJG7trR32T0Ll43QKUSe33 9hdRfEPS5mZBV9YyhIrqWt7S99ZH16lbBx6hjYa0VpDIjgY9kS5An4FOkUhtwIfysX5E SvOg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1765735377; x=1766340177; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=6cy/g9evgHNFkAquxzr3d7GuxFauDlKjTyALOqssS9A=; b=xDxa9HOJrlkwKu5VBncopBLbJglGysChcvGyQXj9yDizZyxyXWcCPmLBoGHP++QO+g Tq3tmPrr1wGmo7TN3GIC0XYrhgWW0idEMcxikO3iMa9ojbQrpbgc2e9SXfXsyVTIx5YS kATbkWXYW0Uu3FyLlTxOeBs6i0bdRf1ahG2KzZ4Gwgh78W9lTJoE9xSRT5+ituZr99s/ HFET7bKKDyjrFIHcvCDAGPsqT4EYZCQAAkW4WBXbouQ/RNuorY8dx0pbsxBLPuK7eLON 6kN9z34Vcx0EvlLiG+AmchdUEaEGvo+bthCilfjuX8se4eJ4sVyrXVmcYQ7l0zYxHTP7 ybTA== X-Forwarded-Encrypted: i=1; AJvYcCXL4pDbCHyvRiDeEcssDlarcVtsJOvBcfdMyGDPihbqnTxvl+CoGxT7+LfP/mvO2WPZcpMmODw0bwH+S4s=@vger.kernel.org X-Gm-Message-State: AOJu0Yw52dcjpUP1vxVN8ytkcasbubhiuj5qMQNkRttBQCQN1pEOrhRG HTh108iph3z/4t7HADOeUhPnD1TKi7bm077pPs+4stAxN47uPoNlU2vP X-Gm-Gg: AY/fxX5VpTzL+L0+rSHr51rOknyCfD/lchkkmcx1cyJjj/qN3+bxDLC8AhmfFrJfZhq 9LpURTy8EcPtwACY4ZT7n7CVn1wnpCsrnpRZliuNTQvRVfXvuRnQ3G4i1OcumEVod1Oxc0hDcAe 0XGkGaRJsM1n7SXwt8sn/+E+aDnoanzf15LSETi7t8Nm+FbX8Hwql1KhAuZQC4mLtIHn5232P+Y 7P+UCr2XKeLiyti/i0kGMVjDH62f1Pf0YMIY4RRMa5BsU/0/b3lak9KUP2DKU2jUcUj17Yo9x7p FBQ70Wa+wH8n7RrdNTJ4V7waGqxdhDgW3xup5VImvldwy4u41hD8niqPXbH/UjoMuWupccaKe5t 9sZpe4kbqvpEcHod8KoLoIhG1Yr+7/9v1FqTUhrRkz72afYeNgVaatImtpDYDnQ5BkZ8f0euP47 IIZBaMaKYP9UuElG7V26QItka6UE1GrBekKXEKDoNpUEYU+m4= X-Google-Smtp-Source: AGHT+IF4CyCgSDlTgHN3haCqqdOhd5KCo9UN7nKgxU7MjiducFCfBbhTh5Ca3dMYLQuvxHuk1OnEHg== X-Received: by 2002:a05:620a:4046:b0:8b2:dd0a:8814 with SMTP id af79cd13be357-8bb3a39ee87mr1219774285a.85.1765735376520; Sun, 14 Dec 2025 10:02:56 -0800 (PST) Received: from dans-laptop.miyazaki.mit.edu ([18.10.148.114]) by smtp.gmail.com with ESMTPSA id af79cd13be357-8bab5d4cd34sm891587485a.47.2025.12.14.10.02.55 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 14 Dec 2025 10:02:56 -0800 (PST) From: Dan Klishch To: legion@kernel.org Cc: containers@lists.linux-foundation.org, ebiederm@xmission.com, keescook@chromium.org, linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org, viro@zeniv.linux.org.uk Subject: Re: [RESEND PATCH v6 0/5] proc: subset=pid: Relax check of mount visibility Date: Sun, 14 Dec 2025 13:02:54 -0500 Message-ID: <20251214180254.799969-1-danilklishch@gmail.com> X-Mailer: git-send-email 2.51.2 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit On 12/14/25 11:40 AM, Alexey Gladkov wrote: > But then, if I understand you correctly, this patch will not be enough > for you. procfs with subset=pid will not allow you to have /proc/meminfo, > /proc/cpuinfo, etc. Hmm, I didn't think of this. sunwalker-box only exposes cpuinfo and PID tree to the sandboxed programs (empirically, this is enough for most of programs you want sandboxing for). With that in mind, this patch and a FUSE providing an overlay with cpuinfo / seccomp intercepting opens of /proc/cpuinfo / a small kernel patch with a new mount option for procfs to expose more static files still look like a clean solution to me. >> Also, correct me if I am wrong, installing ebpf controller requires >> CAP_BPF in initial userns, so rootless podman will not be able to mask >> /proc "properly" even if someone sends a patch switching it to ebpf. > > You can turn on /proc/sys/kernel/unprivileged_bpf_disabled. $ cat /proc/sys/kernel/unprivileged_bpf_disabled 0 $ unshare -pfr --mount-proc $ ./proc-controller -p deny /proc/cpuinfo libbpf: prog 'proc_access_restrict': BPF program load failed: Operation not permitted libbpf: prog 'proc_access_restrict': failed to load: -1 libbpf: failed to load object './proc-controller.bpf.o' proc-controller: ERROR: loading BPF object file failed I think only packet filters are allowed to be installed by non-root. Thanks, Dan Klishch