Alexey Dobriyan <adobriyan@xxxxxxxxx> writes:
> On Thu, Dec 09, 2010 at 05:20:27PM +0000, Serge E. Hallyn wrote:
>> struct uts_namespace {
>> struct kref kref;
>> struct new_utsname name;
>> + struct user_namespace *user_ns;
>
> You're going to add these to the rest?
That is the idea.
namespaces and other objects of interest will keep a user_ns
pointer referencing the context in which they were created.
I took a quick look and all of the namespaces seem to have capability
checks that we want to allow if you are in the proper context.
What is particularly interesting is that this makes a root user in
something other than the init_user_ns with all capabilities essentially
a normal user because capable(CAP_XXX) becomes capable(&init_user_ns, CAP_XXX).
And as such will always fail except where we have updated the capability
checks.
Eric
_______________________________________________
Containers mailing list
Containers@xxxxxxxxxxxxxxxxxxxxxxxxxx
https://lists.linux-foundation.org/mailman/listinfo/containers
