Re: [PATCH v7 2/2] overlayfs: override_creds=off option bypass creator_cred

2018-11-06 Thread Vivek Goyal
On Mon, Nov 05, 2018 at 01:21:14PM -0800, Mark Salyzyn wrote: > By default, all access to the upper, lower and work directories is the > recorded mounter's MAC and DAC credentials. The incoming accesses are > checked against the caller's credentials. > > If the principles of least privilege are a

[PATCH v7 2/2] overlayfs: override_creds=off option bypass creator_cred

2018-11-05 Thread Mark Salyzyn
By default, all access to the upper, lower and work directories is the recorded mounter's MAC and DAC credentials. The incoming accesses are checked against the caller's credentials. If the principles of least privilege are applied, the mounter's credentials might not overlap the credentials of t