From 86b6d7f4346c6b85c60aaae993ce5b27dfff6bea Mon Sep 17 00:00:00 2001 From: Karel Zak Date: Mon, 27 Feb 2017 12:09:35 +0100 Subject: unshare: add note about sysfs and procfs Addresses: https://bugzilla.redhat.com/show_bug.cgi?id=1390057 Signed-off-by: Karel Zak --- sys-utils/unshare.1 | 5 +++++ 1 file changed, 5 insertions(+) (limited to 'sys-utils/unshare.1') diff --git a/sys-utils/unshare.1 b/sys-utils/unshare.1 index 7c7d144d1..dd12c7446 100644 --- a/sys-utils/unshare.1 +++ b/sys-utils/unshare.1 @@ -183,6 +183,11 @@ Display version information and exit. .TP .BR \-h , " \-\-help" Display help text and exit. +.SH NOTES +The proc and sysfs filesystems mounting as root in a user namespace have to be +restricted so that a less privileged user can not get more access to sensitive +files that a more privileged user made unavailable. In short the rule for proc +and sysfs is as close to a bind mount as possible. .SH EXAMPLES .TP .B # unshare --fork --pid --mount-proc readlink /proc/self -- cgit v1.2.3-55-g7522