Re: CVE request: Linux kernel silently ignores MS_RDONLY for bind mounts

[Daniel Micay <danielmicay () gmail com>]

The commit adding this in 2.6.26 did actually document the weird
behaviour, so I guess it's just "by design". Users of the API like LXC,
Docker and systemd would likely have to iterate over /proc/self/mounts
and remount everything due to the way MS_REC works. Anyway, there's
clearly something wrong here when containers are claiming to have a
read-only mount feature but writes to the directory tree aren't prevented...

Attachment: signature.asc
Description: OpenPGP digital signature