2 ms·
For me personally a potential application seems to be embedding general purpose languages as scripting tools within nonprivileged applications; such a chroot wo
by PeterisP 6y ago
For me personally a potential application seems to be embedding general purpose languages as scripting tools within nonprivileged applications; such a chroot would make it easier for the app to grant some filesystem access to a potentially malicious script without trying to restrict the language, API and libraries used for that.
- remexre 6y agoWhy not use a mount namespace? And how are you creating a /dev without root?
- Spivak 6y agoI feel like you're assuming that mount namespaces are something greater than they actually are. You still need chroot(2) or pivot_root(2) to actually put a process into its own isolated directory. There's no magic here. Try running `unshare -m` to see what it's like in "just" a mount namespace.