diff options
| -rw-r--r-- | sys-utils/unshare.1 | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/sys-utils/unshare.1 b/sys-utils/unshare.1 index 7c7d144d1..dd12c7446 100644 --- a/sys-utils/unshare.1 +++ b/sys-utils/unshare.1 @@ -183,6 +183,11 @@ Display version information and exit. .TP .BR \-h , " \-\-help" Display help text and exit. +.SH NOTES +The proc and sysfs filesystems mounting as root in a user namespace have to be +restricted so that a less privileged user can not get more access to sensitive +files that a more privileged user made unavailable. In short the rule for proc +and sysfs is as close to a bind mount as possible. .SH EXAMPLES .TP .B # unshare --fork --pid --mount-proc readlink /proc/self |