summaryrefslogtreecommitdiffstats
path: root/scripts/mod
diff options
context:
space:
mode:
authorEric W. Biederman <ebiederm@xmission.com>2012-12-14 08:50:54 -0800
committerEric W. Biederman <ebiederm@xmission.com>2012-12-14 18:36:26 -0800
commitaa6d054e5ce94720797ca260392a74dbced56412 (patch)
tree4e7093d4e288238f0514187e87b13738504a21df /scripts/mod
parent5e4a08476b50fa39210fca82e03325cc46b9c235 (diff)
downloadlinux-aa6d054e5ce94720797ca260392a74dbced56412.tar.bz2
userns: Add a more complete capability subset test to commit_creds
When unsharing a user namespace we reduce our credentials to just what can be done in that user namespace. This is a subset of the credentials we previously had. Teach commit_creds to recognize this is a subset of the credentials we have had before and don't clear the dumpability flag. This allows an unprivileged program to do: unshare(CLONE_NEWUSER); fd = open("/proc/self/uid_map", O_RDWR); Where previously opening the uid_map writable would fail because the the task had been made non-dumpable. Acked-by: Serge Hallyn <serge.hallyn@canonical.com> Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Diffstat (limited to 'scripts/mod')
0 files changed, 0 insertions, 0 deletions