# Personal blog of Christian Brauner Published articles for Personal blog of Christian Brauner. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Listing all mounts in all mount namespaces DevFeed: [Listing all mounts in all mount namespaces]() Original publisher: [Read original article]() Author: Christian Brauner Published: 2024-12-15T23:00:00Z Content type: tutorial Language: en Sources: [Personal blog of Christian Brauner]() Topics: [mount](), [Linux]() Tags: [api](), [introduction](), [linux](), [mount]() ### AI overview A technical explanation of Linux APIs and system calls for retrieving mount information, iterating through mounts and mount subtrees, and listing mounts in other mount namespaces. It also describes retrieving mount namespace IDs and iterating through mount namespaces. ### Source excerpt Introduction ## Mounting into mount namespaces DevFeed: [Mounting into mount namespaces]() Original publisher: [Read original article]() Author: Christian Brauner Published: 2023-02-27T23:00:00Z Content type: article Language: en Sources: [Personal blog of Christian Brauner]() Topics: [mount](), [kernels](), [file](), [coding]() Tags: [coding](), [filesystem](), [kernels](), [mount]() ### AI overview This article examines how to insert new mounts into a running container's mount namespace. It discusses the complexity of mount operations, a legacy userspace path-verification approach, and a newer approach intended to prevent symlink attacks by verifying paths and opening their final components before mounting. ### Source excerpt Introduction ## An excursion into a mount propagation bug DevFeed: [An excursion into a mount propagation bug]() Original publisher: [Read original article]() Author: Christian Brauner Published: 2023-01-04T23:00:00Z Content type: article Language: en Sources: [Personal blog of Christian Brauner]() Topics: [mount](), [bug](), [debugging]() Tags: [bug](), [data](), [debugging](), [mount](), [test]() ### AI overview An article examines a difficult-to-reproduce mount propagation bug involving a network namespace persisted by bind-mounting it in a separate mount namespace. It describes how the bug was reproduced and clarifies the shared, peer, master, and slave mount concepts used to understand the relevant code. ### Source excerpt Introduction ## Managing a kernel patch series with b4 DevFeed: [Managing a kernel patch series with b4]() Original publisher: [Read original article]() Author: Christian Brauner Published: 2023-01-01T23:00:00Z Content type: tutorial Language: en Sources: [Personal blog of Christian Brauner]() Topics: [Kernel]() Tags: [blog](), [kernel]() ### AI overview A live, first-person walkthrough of managing a Linux kernel patch series with b4. The author documents sending a tested patch, enrolling a branch, handling cover-letter commits, and inspecting the resulting patch. ### Source excerpt This is a (live-[?])blog about managing a patch series solely with b4. It's "live" as I'm writing this down while fumbling my way through this adventure. No corrections other than grammer and spelling (but no guarantees for the correctness of either). ## Using the Seccomp Notifier to Intercept bpf() in Unprivileged Containers DevFeed: [Using the Seccomp Notifier to Intercept bpf() in Unprivileged Containers]() Original publisher: [Read original article]() Author: Christian Brauner Published: 2020-08-06T22:00:00Z Content type: tutorial Language: en Sources: [Personal blog of Christian Brauner]() Topics: [Containers](), [Kernel]() Tags: [containers](), [demo](), [kernel](), [pull-request]() ### AI overview This short sequel demonstrates how seccomp notifier features can intercept syscalls involving file descriptors. It shows LXD supervising syscalls in unprivileged containers so a nested unprivileged container can load its own device profile in the cgroup2 hierarchy. ### Source excerpt In my last article I looked at the seccomp notifier in detail and how it allows us to make unprivileged containers way more capable (Sorry, kernel joke.). This is the (very) crazy (but very short) sequel. (Sorry Jon, no novella this time. :)) ## The Seccomp Notifier - New Frontiers in Unprivileged Container Development DevFeed: [The Seccomp Notifier - New Frontiers in Unprivileged Container Development]() Original publisher: [Read original article]() Author: Christian Brauner Published: 2020-07-22T22:00:00Z Content type: article Language: en Sources: [Personal blog of Christian Brauner]() Topics: [Linux Kernel](), [Kernel](), [Containers](), [Development]() Tags: [containers](), [development](), [kernel](), [linux-kernel](), [technical]() ### AI overview This article examines the Linux seccomp notify feature, its kernel and userspace development, and the new possibilities it enables for unprivileged containers. It also explains how Linux namespaces contribute to container isolation and why privilege checks can behave differently inside user namespaces. ### Source excerpt Introduction ## Linux Kernel VFSisms DevFeed: [Linux Kernel VFSisms]() Original publisher: [Read original article]() Author: Christian Brauner Published: 2019-06-27T22:00:00Z Content type: tutorial Language: en Sources: [Personal blog of Christian Brauner]() Topics: [Kernel](), [Linux Kernel](), [Linux](), [file](), [function]() Tags: [filesystem](), [function](), [kernel](), [linux](), [linux-kernel](), [maintainers]() ### AI overview A collection of practical notes on Linux Kernel VFS internals, focusing on when to install or reserve file descriptors and how to initialize directory inodes safely. The author cautions that the material may contain errors and should not be relied on as authoritative guidance. ### Source excerpt Introduction ## CVE-2019-5736 and the Security Meaning of Privileged Containers DevFeed: [CVE-2019-5736 and the Security Meaning of Privileged Containers]() Original publisher: [Read original article]() Author: Christian Brauner Published: 2019-02-11T23:00:00Z Content type: article Language: en Sources: [Personal blog of Christian Brauner]() Topics: [container](), [Containers](), [vulnerability](), [Exploit](), [Security](), [implementation]() Tags: [containers](), [cve](), [exploit](), [lxc](), [runc](), [security](), [vulnerability]() ### AI overview The article examines CVE-2019-5736, a vulnerability that could let a malicious container overwrite the host runc binary and gain root-level code execution. It then develops a more precise definition of privileged containers based on whether ID 0 has the same semantics inside and outside the container. ### Source excerpt Introduction (CVE-2019-5736)