lkml.org 
[lkml]   [2008]   [Dec]   [5]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    From
    Date
    SubjectRe: [PATCH 2/2] user namespaces: require cap_set{ug}id for CLONE_NEWUSER
    "Serge E. Hallyn" <serue@us.ibm.com> writes:

    > While ideally CLONE_NEWUSER will eventually require no
    > privilege, the required permission checks are currently
    > not there. As a result, CLONE_NEWUSER has the same effect
    > as a setuid(0)+setgroups(1,"0"). While we already require
    > CAP_SYS_ADMIN, requiring CAP_SETUID and CAP_SETGID seems
    > appropriate.

    This looks reasonable. For the short term we will need a greater
    set of caps to be able to do all of the interesting things.

    Personally the user namespace only becomes interesting when we
    start to be able to move in the other direction and remove the
    set of capabilities requires to create it.

    Eric


    \
     
     \ /
      Last update: 2008-12-05 17:29    [W:5.431 / U:0.140 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site