3 ms·

Oops -- A developer whose app needs to run as root (for a well-documented reason, and with a tight systemd sandbox hiding most of the filesystem from it)

• NewJazz 2y ago
  If it is running as root, can't it just manipulate its mount namespace at will? Mount devtmpfs, then mount user partitions.
  • superb_dev 2y ago
    Systemd can put it in its own namespaces, like a container
  • hackernudes 2y ago
    I believe one can use "capabilities" and seccomp to lock down a superuser process.