unshare: add note about sysfs and procfs

Addresses: https://bugzilla.redhat.com/show_bug.cgi?id=1390057
Signed-off-by: Karel Zak <kzak@redhat.com>

diff --git a/sys-utils/unshare.1 b/sys-utils/unshare.1
index 7c7d144d175a255f65e9fd2bd50d719e476a2e80..dd12c74461e64c3d8dd5e81f0de06ef4d8fb9a42 100644 (file)
--- a/sys-utils/unshare.1
+++ b/sys-utils/unshare.1
@@ -183,6 +183,11 @@ Display version information and exit.
 .TP
 .BR \-h , " \-\-help"
 Display help text and exit.
+.SH NOTES
+The proc and sysfs filesystems mounting as root in a user namespace have to be
+restricted so that a less privileged user can not get more access to sensitive
+files that a more privileged user made unavailable. In short the rule for proc
+and sysfs is as close to a bind mount as possible.
 .SH EXAMPLES
 .TP
 .B # unshare --fork --pid --mount-proc readlink /proc/self