On Tue, Jul 12, 2016 at 9:16 AM, Eric W. Biederman <ebiederm@xxxxxxxxxxxx> wrote: > Not logging capabilities outside of the initial user namespace is > certainly the conservative place to start, and what selinux does. FYI, we added some basic userns capability smarts to SELinux in Linux 4.7. commit 8e4ff6f228e4722cac74db716e308d1da33d744f Author: Stephen Smalley <sds@xxxxxxxxxxxxx> Date: Fri Apr 8 13:52:00 2016 -0400 selinux: distinguish non-init user namespace capability checks Distinguish capability checks against a target associated with the init user namespace versus capability checks against a target associated with a non-init user namespace by defining and using separate security classes for the latter. This is needed to support e.g. Chrome usage of user namespaces for the Chrome sandbox without needing to allow Chrome to also exercise capabilities on targets in the init user namespace. Suggested-by: Dan Walsh <dwalsh@xxxxxxxxxx> Signed-off-by: Stephen Smalley <sds@xxxxxxxxxxxxx> Signed-off-by: Paul Moore <paul@xxxxxxxxxxxxxx> -- paul moore www.paul-moore.com -- To unsubscribe from this list: send the line "unsubscribe cgroups" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
