Messages in this thread | | | Date | Fri, 25 Sep 2015 07:49:24 -0500 | From | Seth Forshee <> | Subject | Re: [PATCH v4 4/7] fs: Limit file caps to the user namespace of the super block |
| |
On Thu, Sep 24, 2015 at 04:59:35PM -0500, Eric W. Biederman wrote: > Seth Forshee <seth.forshee@canonical.com> writes: > > > Capability sets attached to files must be ignored except in the > > user namespaces where the mounter is privileged, i.e. s_user_ns > > and its descendants. Otherwise a vector exists for gaining > > privileges in namespaces where a user is not already privileged. > > > > Add a new helper function, in_user_ns(), to test whether a user > > namespace is the same as or a descendant of another namespace. > > Use this helper to determine whether a file's capability set > > should be applied to the caps constructed during exec. > > No issues with this but given that we always pass current_user_ns() > we may want to simplify the users of in_user_ns by renaming it > current_in_user_ns() and hard codeing current_user_ns().
Sure, if that's what you prefer then I'll change it.
Seth
| |