Messages in this thread | | | Date | Mon, 2 Feb 2015 22:31:08 +0100 | Subject | Re: [PATCH 2/2] user_namespaces.7: Update the documention to reflect the fixes for negative groups | From | Alban Crequy <> |
| |
Hello,
Thanks for updating the man page.
On 12 December 2014 at 22:54, Eric W. Biederman <ebiederm@xmission.com> wrote: (...) > Furthermore to preserve in some form the useful applications that have > been setting gid_map without privilege the file /proc/[pid]/setgroups > was added to allow disabling setgroups. With the setgroups system > call permanently disabled in a user namespace it again becomes safe to > allow writes to gid_map without privilege. > > Here is my meager attempt to update user_namespaces.7 to reflect these > issues.
The program userns_child_exec.c in user_namespaces.7 should be updated to write in /proc/.../setgroups, near the line: /* Update the UID and GID maps in the child */
Otherwise, the example given in the manpage does not work: $ ./userns_child_exec -p -m -U -M '0 1000 1' -G '0 1000 1' bash
Cheers, Alban
| |