[PATCH v3 0/1] Relax restrictions on user.* xattr

Bruce Fields bfields at redhat.com
Tue Sep 14 13:59:19 UTC 2021

On Tue, Sep 14, 2021 at 8:52 AM Vivek Goyal <vgoyal at redhat.com> wrote:
> Same is the requirement for regular containers and that's why
> podman (and possibly other container managers), make top level
> storage directory only readable and searchable by root, so that
> unpriveleged entities on host can not access container root filesystem
> data.

Note--if that directory is on NFS, making it readable and searchable
by root is very weak protection, since it's often possible for an
attacker to guess filehandles and access objects without the need for
directory lookups.


More information about the Linux-security-module-archive mailing list