3 ms·
If it is running as root, can't it just manipulate its mount namespace at will? Mount devtmpfs, then mount user partitions.
by NewJazz 2y ago
If it is running as root, can't it just manipulate its mount namespace at will? Mount devtmpfs, then mount user partitions.
- superb_dev 2y agoSystemd can put it in its own namespaces, like a container
- hackernudes 2y agoI believe one can use "capabilities" and seccomp to lock down a superuser process.