Waaaay behind on my email...
On 06/07/2013 04:34:59 AM, Daniel P. Berrange wrote:
On Thu, Jun 06, 2013 at 11:15:11AM -0700, Eric W. Biederman wrote:
> "Serge E. Hallyn" <serge@xxxxxxxxxx> writes:
> setns requires CAP_SYS_ADMIN because changing the namespaces for
your
> children can result in tricking a suid root application and thus
lead
> to privilege escalation.
Yep, ok I see that from the example shown earlier in the thread.
> If you run setns inside a user namespace that you control the
privilege
> escalation is not possible and so setns is allowed.
What are the privilege requirements for being able to call setns() on
a user namespace FD ?
Thinking some more, if there was a setpidns(pid_t containerpid)
syscall
which unconditionally joined the caller to all namespaces associated
with
the target pid, then you'd not have the security risk described,
right ?
Sounds like you want a reparent_to_init() that works for a container's
init.
Rob
_______________________________________________
Containers mailing list
Containers@xxxxxxxxxxxxxxxxxxxxxxxxxx
https://lists.linuxfoundation.org/mailman/listinfo/containers
