lkml.org 
[lkml]   [2015]   [Feb]   [11]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
Date
SubjectRe: [PATCH 1/2] proc.5: Document /proc/[pid]/setgroups
Hi Eric,

Ping!

Cheers,

Michael



On 2 February 2015 at 16:36, Michael Kerrisk (man-pages)
<mtk.manpages@gmail.com> wrote:
> [Adding Josh to CC in case he has anything to add.]
>
> On 12/12/2014 10:54 PM, Eric W. Biederman wrote:
>>
>> Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>
>> ---
>> man5/proc.5 | 15 +++++++++++++++
>> 1 file changed, 15 insertions(+)
>>
>> diff --git a/man5/proc.5 b/man5/proc.5
>> index 96077d0dd195..d661e8cfeac9 100644
>> --- a/man5/proc.5
>> +++ b/man5/proc.5
>> @@ -1097,6 +1097,21 @@ are not available if the main thread has already terminated
>> .\" Added in 2.6.9
>> .\" CONFIG_SCHEDSTATS
>> .TP
>> +.IR /proc/[pid]/setgroups " (since Linux 3.19-rc1)"
>> +This file reports
>> +.BR allow
>> +if the setgroups system call is allowed in the current user namespace.
>> +This file reports
>> +.BR deny
>> +if the setgroups system call is not allowed in the current user namespace.
>> +This file may be written to with values of
>> +.BR allow
>> +and
>> +.BR deny
>> +before
>> +.IR /proc/[pid]/gid_map
>> +is written to (enabling setgroups) in a user namespace.
>> +.TP
>> .IR /proc/[pid]/smaps " (since Linux 2.6.14)"
>> This file shows memory consumption for each of the process's mappings.
>> (The
>
> Hi Eric,
>
> Thanks for this patch. I applied it, and then tried to work in
> quite a few other details gleaned from the source code and commit
> message, and Jon Corbet's article at http://lwn.net/Articles/626665/.
> Could you please let me know if the following is correct:
>
> /proc/[pid]/setgroups (since Linux 3.19)
> This file displays the string "allow" if processes in
> the user namespace that contains the process pid are
> permitted to employ the setgroups(2) system call, and
> "deny" if setgroups(2) is not permitted in that user
> namespace.
>
> A privileged process (one with the CAP_SYS_ADMIN capa‐
> bility in the namespace) may write either of the strings
> "allow" or "deny" to this file before writing a group ID
> mapping for this user namespace to the file
> /proc/[pid]/gid_map. Writing the string "deny" prevents
> any process in the user namespace from employing set‐
> groups(2).
>
> The default value of this file in the initial user
> namespace is "allow".
>
> Once /proc/[pid]/gid_map has been written to (which has
> the effect of enabling setgroups(2) in the user names‐
> pace), it is no longer possible to deny setgroups(2) by
> writing to /proc/[pid]/setgroups.
>
> A child user namespace inherits the /proc/[pid]/gid_map
> setting from its parent.
>
> If the setgroups file has the value "deny", then the
> setgroups(2) system call can't subsequently be reenabled
> (by writing "allow" to the file) in this user namespace.
> This restriction also propagates down to all child user
> namespaces of this user namespace.
>
> Thanks,
>
> Michael
>
> --
> Michael Kerrisk
> Linux man-pages maintainer; http://www.kernel.org/doc/man-pages/
> Linux/UNIX System Programming Training: http://man7.org/training/



--
Michael Kerrisk
Linux man-pages maintainer; http://www.kernel.org/doc/man-pages/
Linux/UNIX System Programming Training: http://man7.org/training/


\
 
 \ /
  Last update: 2015-02-11 09:21    [W:0.125 / U:0.784 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site