No description available
No history found.
README:
overlay-userns DKMS kernel module
=================================
The purpose of the overlay-userns DKMS kernel module is to enable overlay
filesystem mounts within user namespaces. Except by the Ubuntu community [1],
this is expected to be a security risk [2] and thus is not enabled on normal
Linux kernels. To enable the feature in official kernels of your favourite
distro anyway, you can register and load this DKMS module which patches the
FS_USERNS_MOUNT filesystem flag in your running kernel.
The good points for patching your kernel with this module at runtime:
* You can unload the module after use if you want to reduce the risks again.
(Note: current overlay mountpoints will reside!)
* There is no need to manually rebuild (and check for) new kernel versions, as
your distro can do it the way it does right now.
* DKMS rebuilds the module automatically for your currently running kernel(s)
without further manual activity requirements.
The bad points when patching your kernel with this module:
* The security risk [2] remains.
* You run a tainted kernel.
[1]: Ubuntu allows unprivileged mounting of overlay filesystem
https://lists.ubuntu.com/archives/kernel-team/2014-February/038091.html
[2]: User namespaces + overlayfs = root privileges
https://lwn.net/Articles/671641/
-- Nicolas Schier <n.schier@avm.de> Wed, 14 Nov 2018 22:04:48 +0100
=================================
The purpose of the overlay-userns DKMS kernel module is to enable overlay
filesystem mounts within user namespaces. Except by the Ubuntu community [1],
this is expected to be a security risk [2] and thus is not enabled on normal
Linux kernels. To enable the feature in official kernels of your favourite
distro anyway, you can register and load this DKMS module which patches the
FS_USERNS_MOUNT filesystem flag in your running kernel.
The good points for patching your kernel with this module at runtime:
* You can unload the module after use if you want to reduce the risks again.
(Note: current overlay mountpoints will reside!)
* There is no need to manually rebuild (and check for) new kernel versions, as
your distro can do it the way it does right now.
* DKMS rebuilds the module automatically for your currently running kernel(s)
without further manual activity requirements.
The bad points when patching your kernel with this module:
* The security risk [2] remains.
* You run a tainted kernel.
[1]: Ubuntu allows unprivileged mounting of overlay filesystem
https://lists.ubuntu.com/archives/kernel-team/2014-February/038091.html
[2]: User namespaces + overlayfs = root privileges
https://lwn.net/Articles/671641/
-- Nicolas Schier <n.schier@avm.de> Wed, 14 Nov 2018 22:04:48 +0100
Hints:
Before first commit, do not forget to setup your git environment:
Clone this repository using HTTP(S):
Clone this repository using ssh (do not forget to upload a key first):
Clone this repository using git:
You are allowed to anonymously push to this repository.
This means that your pushed commits will automatically be transformed into a merge request:
Before first commit, do not forget to setup your git environment:
git config --global user.name "your_name_here"
git config --global user.email "your@email_here"
git config --global user.email "your@email_here"
Clone this repository using HTTP(S):
git clone https://rocketgit.com/user/nicolas/overlay-userns-dkms
Clone this repository using ssh (do not forget to upload a key first):
git clone ssh://rocketgit@ssh.rocketgit.com/user/nicolas/overlay-userns-dkms
Clone this repository using git:
git clone git://git.rocketgit.com/user/nicolas/overlay-userns-dkms
You are allowed to anonymously push to this repository.
This means that your pushed commits will automatically be transformed into a merge request:
... clone the repository ...
... make some changes and some commits ...
git push origin main
... make some changes and some commits ...
git push origin main
RocketGit
Rocket your launch!
Rocket your launch!