diff options
| author | Eric W. Biederman <ebiederm@xmission.com> | 2012-07-26 00:50:47 -0700 |
|---|---|---|
| committer | Eric W. Biederman <ebiederm@xmission.com> | 2012-11-20 04:17:41 -0800 |
| commit | b33c77ef23dd3ec5692c9c0cc739a3f5f0f2baae (patch) | |
| tree | dfb2ecd0acb0bd1ee708a685722b27afd63792e5 /kernel/nsproxy.c | |
| parent | 37657da3c5d4a3bbbbb9d3b78f53a8134a0abae0 (diff) | |
| download | lwn-b33c77ef23dd3ec5692c9c0cc739a3f5f0f2baae.tar.gz lwn-b33c77ef23dd3ec5692c9c0cc739a3f5f0f2baae.zip | |
userns: Allow unprivileged users to create new namespaces
If an unprivileged user has the appropriate capabilities in their
current user namespace allow the creation of new namespaces.
Acked-by: Serge Hallyn <serge.hallyn@canonical.com>
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Diffstat (limited to 'kernel/nsproxy.c')
| -rw-r--r-- | kernel/nsproxy.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/kernel/nsproxy.c b/kernel/nsproxy.c index 7f8b051fc19f..a214e0e9035f 100644 --- a/kernel/nsproxy.c +++ b/kernel/nsproxy.c @@ -122,6 +122,7 @@ out_ns: int copy_namespaces(unsigned long flags, struct task_struct *tsk) { struct nsproxy *old_ns = tsk->nsproxy; + struct user_namespace *user_ns = task_cred_xxx(tsk, user_ns); struct nsproxy *new_ns; int err = 0; @@ -134,7 +135,7 @@ int copy_namespaces(unsigned long flags, struct task_struct *tsk) CLONE_NEWPID | CLONE_NEWNET))) return 0; - if (!capable(CAP_SYS_ADMIN)) { + if (!ns_capable(user_ns, CAP_SYS_ADMIN)) { err = -EPERM; goto out; } @@ -191,7 +192,7 @@ int unshare_nsproxy_namespaces(unsigned long unshare_flags, CLONE_NEWNET | CLONE_NEWPID))) return 0; - if (!capable(CAP_SYS_ADMIN)) + if (!nsown_capable(CAP_SYS_ADMIN)) return -EPERM; *new_nsp = create_new_namespaces(unshare_flags, current, |