Messages in this thread | | | From | Andy Lutomirski <> | Date | Mon, 17 Dec 2012 11:03:10 -0800 | Subject | Re: [PATCH 0/4] user namespace fixes |
| |
On Fri, Dec 14, 2012 at 2:01 PM, Eric W. Biederman <ebiederm@xmission.com> wrote: > > These are fixes from Andys review of my user namespace tree. > > The first two patches are critical must fix fixes. > > The third patch fixing commit_creds is a nice to have but fixing it > would be good. > > Andy, Serge if you could give these patches a once over to make certain > I am not doing something stupid. > > Thank you, > Eric > > --- > > Eric W. Biederman (4): > Fix cap_capable to only allow owners in the parent user namespace to have caps.
For whatever reason, I didn't get the actual email. Assuming this is 5e4a08476b50fa39210fca82e03325cc46b9c235:
Acked-by: Andy Lutomirski <luto@amacapital.net>
However, this comment: /* * The owner of the user namespace in the parent of the * user namespace has all caps. */ could use work. I agree with the code, but I gave up on understanding the comment.
> userns: Require CAP_SYS_ADMIN for most uses of setns. > userns: Add a more complete capability subset test to commit_creds > userns: Fix typo in description of the limitation of userns_install >
--Andy
| |