On Wed, Jan 27, 2016 at 9:22 AM, Jann Horn <jann@xxxxxxxxx> wrote: > I think it sounds good from a security perspective. I'm a bit late to the game, but I have a question: why should this be keyed to the *root* uid of the namespace in particular? Certainly if user foo trusts the cap bits on some file, then user foo might trust those caps to be exerted over any namespace that user foo owns, since user foo owns the namespace. But another option would be to include a list of uids and gids such that the cap bits on the file are trusted by any namespace that maps only uids and gids in the list. After all, the existence of a namespace with root user foo that also maps bar and baz along with a file with caps set means that, if baz can get to the file and permissions are set appropriately, then baz now owns bar (via any number of fs-related capabilities). So maybe bar and baz should have to be listed as well. But maybe this doesn't matter. In any event, at the end of the day, the right answer to all of this is to stop using setuid and stop using cap bits too and start using privileged daemons or other things that don't use the eternally fragile grant-privilege-on-execve mechanisms. --Andy -- To unsubscribe from this list: send the line "unsubscribe linux-api" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
