[PATCH v3 0/1] Relax restrictions on user.* xattr

[Bruce Fields]

On Tue, Sep 14, 2021 at 8:52 AM Vivek Goyal <vgoyal at redhat.com> wrote:
> Same is the requirement for regular containers and that's why
> podman (and possibly other container managers), make top level
> storage directory only readable and searchable by root, so that
> unpriveleged entities on host can not access container root filesystem
> data.

Note--if that directory is on NFS, making it readable and searchable
by root is very weak protection, since it's often possible for an
attacker to guess filehandles and access objects without the need for
directory lookups.

--b.