On Tue, Aug 27, 2013 at 02:46:27PM -0700, Eric W. Biederman wrote: > > Don't allow mounting sysfs unless the caller has CAP_SYS_ADMIN rights > over the net namespace. The principle here is if you create or have > capabilities over it you can mount it, otherwise you get to live with > what other people have mounted. > > Instead of testing this with a straight forward ns_capable call, > perform this check the long and torturous way with kobject helpers, > this keeps direct knowledge of namespaces out of sysfs, and preserves > the existing sysfs abstractions. > > Signed-off-by: "Eric W. Biederman" <ebiederm@xxxxxxxxxxxx> Odd, but makes sense. Acked-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> -- To unsubscribe from this list: send the line "unsubscribe linux-fsdevel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
