https://bugzilla.kernel.org/show_bug.cgi?id=120671 --- Comment #4 from Michael Kerrisk <mtk.manpages@xxxxxxxxx> --- (In reply to Michał Zegan from comment #2) > Well... For example, cap_sys_module does not work in user namespace, doesn't > it? cap_sys_mknod last i checked did not work in userns, but may be wrong. Yes, but that is conveyed in a sentence in user_namespaces(7): Having a capability inside a user namespace permits a process to perform operations (that require privilege) only on resources governed by that namespace. [1] Loading a kernel module or creating a device node are not governed by any of the 7 current namespace types. What I mean here: this is not a question of whether particular capabilities work in a namespace, rather what operations / abilities are associated with various namespaces. > About mounting filesystems, there is probably a whitelist. If I recall > correctly you are unable to mount any block based fs like ext4 inside of the > userns, like you have no permissions to mount most of them except tmpfs, > proc and such like. [2] This isn't correct as far as I know, but if you can show me an interesting counterexample... > There may be other restrictions I am not aware of, but > those are some I know, unless I am wrong. It will help to clarify some > things that are just not present in that manpage. So far, I don't see a real problem in the man page(s). (But maybe, the explanations on the first point could be more detailed.) -- You are receiving this mail because: You are watching the assignee of the bug.-- To unsubscribe from this list: send the line "unsubscribe linux-man" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
