Messages in this thread | | | Date | Fri, 9 Oct 2015 10:34:22 +0300 | From | Sergei Zviagintsev <> | Subject | Re: [PATCH 07/44] kdbus: Fix comment on translation of caps between namespaces |
| |
Hi,
On Fri, Oct 09, 2015 at 11:43:22AM +0800, Hillf Danton wrote: > > @@ -730,15 +730,21 @@ static void kdbus_meta_export_caps(struct kdbus_meta_caps *out, > > > > /* > > * This translates the effective capabilities of 'cred' into the given > > - * user-namespace. If the given user-namespace is a child-namespace of > > - * the user-namespace of 'cred', the mask can be copied verbatim. If > > - * not, the mask is cleared. > > - * There's one exception: If 'cred' is the owner of any user-namespace > > - * in the path between the given user-namespace and the user-namespace > > - * of 'cred', then it has all effective capabilities set. This means, > > - * the user who created a user-namespace always has all effective > > - * capabilities in any child namespaces. Note that this is based on the > > - * uid of the namespace creator, not the task hierarchy. > > + * user namespace according to the following rules: > > + * > > + * - If 'cred' is a member of the given user namespace or any of its > > + * parent user namespaces, the mask is copied verbatim. That is, if > > Clearer/Better if "if not, the mask is cleared." is reserved.
Indeed, thanks!
> > > + * a process has a capability in a user namespace, then it has it in > > + * all child user namespaces too. > > + * > > + * - If the effective UID of 'cred' matches the owner of the given user > > + * namespace or any of its parent user namespaces and 'cred' itself > > + * resides in the parent of that user namespace which it owns, then > > + * it has all effective capabilities set. This means that the user > > + * who created a user namespace always has all effective capabilities > > + * in all child namespaces while staying in the parent of the user > > + * namespace which it owns. Note that this is based on the UID of the > > + * namespace creator, not the task hierarchy. > > */ > > for (iter = user_ns; iter; iter = iter->parent) { > > if (iter == cred->user_ns) { > > -- > > 1.8.3.1 > > >
| |