Messages in this thread | | | From | (Eric W. Biederman) | Date | Wed, 19 Nov 2008 17:41:21 -0800 | Subject | Re: Current state of CLONE_NEWUSER? |
| |
"Michael Kerrisk" <mtk.manpages@googlemail.com> writes:
> Hi Serge, > > What is the current status of CLONE_NEWUSER? I'm currently trying to > test this flag in preparation for documenting it in the clone(2) man > page, but am running into an ENOMEM error from the clone() call, which > seems to occur after a failure in kobject_init_and_add() in the > following call sequence: > > clone_user_ns() --> alloc_uid() --> uids_user_create() --> > kobject_init_and_add() > > Are there already some test programs somewhere? Is there any > documentation already available for this flag?
This code is definitely still under development.
When complete it should be able to create a new uid namespace, as an unprivileged user. Creating a new process with uid == gid == 0. Have a full set of caps. And have permission to do nothing on the system except read world readable files and write world writable files.
Eric
| |