Messages in this thread | | | Date | Mon, 8 Dec 2008 09:47:21 +1100 (EST) | From | James Morris <> | Subject | Re: [PATCH 2/2] user namespaces: require cap_set{ug}id for CLONE_NEWUSER |
| |
On Fri, 5 Dec 2008, Eric W. Biederman wrote:
> "Serge E. Hallyn" <serue@us.ibm.com> writes: > > > While ideally CLONE_NEWUSER will eventually require no > > privilege, the required permission checks are currently > > not there. As a result, CLONE_NEWUSER has the same effect > > as a setuid(0)+setgroups(1,"0"). While we already require > > CAP_SYS_ADMIN, requiring CAP_SETUID and CAP_SETGID seems > > appropriate. > > Acked-by: "Eric W. Biederman" <ebiederm@xmission.com> > > The patch looks good, and we are likely to need more caps to > actually use it.
Applied to git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6#next
-- James Morris <jmorris@namei.org>
| |