From: Tycho Andersen <tycho.andersen@xxxxxxxxxxxxx> Date: Fri, 5 Feb 2016 09:20:52 -0700 > Operations with the GENL_ADMIN_PERM flag fail permissions checks because > this flag means we call netlink_capable, which uses the init user ns. > > Instead, let's introduce a new flag, GENL_UNS_ADMIN_PERM for operations > which should be allowed inside a user namespace. > > The motivation for this is to be able to run openvswitch in unprivileged > containers. I've tested this and it seems to work, but I really have no > idea about the security consequences of this patch, so thoughts would be > much appreciated. > > v2: use the GENL_UNS_ADMIN_PERM flag instead of a check in each function > v3: use separate ifs for UNS_ADMIN_PERM and ADMIN_PERM, instead of one > massive one > > Reported-by: James Page <james.page@xxxxxxxxxxxxx> > Signed-off-by: Tycho Andersen <tycho.andersen@xxxxxxxxxxxxx> Applied, thanks. _______________________________________________ Containers mailing list Containers@xxxxxxxxxxxxxxxxxxxxxxxxxx https://lists.linuxfoundation.org/mailman/listinfo/containers
