summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorEric W. Biederman <ebiederm@xmission.com>2012-07-26 00:50:47 -0700
committerEric W. Biederman <ebiederm@xmission.com>2012-11-20 04:17:41 -0800
commitb33c77ef23dd3ec5692c9c0cc739a3f5f0f2baae (patch)
treedfb2ecd0acb0bd1ee708a685722b27afd63792e5
parent37657da3c5d4a3bbbbb9d3b78f53a8134a0abae0 (diff)
downloadop-kernel-dev-b33c77ef23dd3ec5692c9c0cc739a3f5f0f2baae.zip
op-kernel-dev-b33c77ef23dd3ec5692c9c0cc739a3f5f0f2baae.tar.gz
userns: Allow unprivileged users to create new namespaces
If an unprivileged user has the appropriate capabilities in their current user namespace allow the creation of new namespaces. Acked-by: Serge Hallyn <serge.hallyn@canonical.com> Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
-rw-r--r--kernel/nsproxy.c5
1 files changed, 3 insertions, 2 deletions
diff --git a/kernel/nsproxy.c b/kernel/nsproxy.c
index 7f8b051..a214e0e 100644
--- a/kernel/nsproxy.c
+++ b/kernel/nsproxy.c
@@ -122,6 +122,7 @@ out_ns:
int copy_namespaces(unsigned long flags, struct task_struct *tsk)
{
struct nsproxy *old_ns = tsk->nsproxy;
+ struct user_namespace *user_ns = task_cred_xxx(tsk, user_ns);
struct nsproxy *new_ns;
int err = 0;
@@ -134,7 +135,7 @@ int copy_namespaces(unsigned long flags, struct task_struct *tsk)
CLONE_NEWPID | CLONE_NEWNET)))
return 0;
- if (!capable(CAP_SYS_ADMIN)) {
+ if (!ns_capable(user_ns, CAP_SYS_ADMIN)) {
err = -EPERM;
goto out;
}
@@ -191,7 +192,7 @@ int unshare_nsproxy_namespaces(unsigned long unshare_flags,
CLONE_NEWNET | CLONE_NEWPID)))
return 0;
- if (!capable(CAP_SYS_ADMIN))
+ if (!nsown_capable(CAP_SYS_ADMIN))
return -EPERM;
*new_nsp = create_new_namespaces(unshare_flags, current,
OpenPOWER on IntegriCloud