Quoting Matt Helsley (matthltc@xxxxxxxxxx): > On Fri, Sep 02, 2011 at 07:56:27PM +0000, Serge Hallyn wrote: > > From: "Serge E. Hallyn" <serge@xxxxxxxxxx> > > I was confused about this patch until I realized that you're not > simply "moving" the capability checks but "distributing" them. Then > you're showing that you'll soon change some to nsown_capable() or > ns_capable() using the strange cpp pattern in the snippet below. > > At least I think that's what you intended. A commit message would > help :). Yes, sorry - Eric convinced me several times to be more conservative in the patch, and I failed to fix the commit msg when squashing the resulting patches. How about the following: ====== user ns: update capable calls when cloning and attaching namespaces Distribute the capable() checks at ns attach into the namespace-specific attach handler. Note the fact that the capable() checks will be changed to targeted checks at both namespace clone and attach methods, but don't actually make that change yet. Until that trigger is pulled, you must have the capabilities targeted toward the initial user namespace in order to do any of these actions, meaning that a task in a child user namespace cannot do them. Once we pull the trigger, a task in a child user namespace will be able to clone new namespaces if it is privileged in its own user namespace, and attach to existing namespaces to which it has privilege. ====== Thanks for taking a look, Matt! -serge _______________________________________________ Containers mailing list Containers@xxxxxxxxxxxxxxxxxxxxxxxxxx https://lists.linux-foundation.org/mailman/listinfo/containers
