Y
HN Search
Hacker News Search
new
|
comments
|
top
|
jobs
Ohjohng8
searching PlanetScale…
1.
▲
2.
▲
3.
▲
4.
▲
5.
▲
6.
▲
4 ms
·
1.
▲
by
Ohjohng8
8y ago
I think in linux you could already do this if you wanted to. unprivileged user namespace + mount namespace -> mount some tmpfs, bind-mount (optionally read-only or noexec), pivot_root and you got an isolated view of the filesystem. You c
2.
▲
by
Ohjohng8
8y ago
I assume that is intended as a security feature to prevent TOCTTOU bugs, especially when a process does not use the *at family of syscalls. I.e. a malicious process can't swap directories under your nose.