Doug / smarc-fsl-linux-kernel

Download as
Browse Code ยป

Commit b33c77ef23dd3ec5692c9c0cc739a3f5f0f2baae

Authored by Eric W. Biederman
1 parent 37657da3c5
Exists in smarc-l5.0.0_1.0.0-ga and in 5 other branches imx_3.10.17_1.0.1_ga, imx_3.10.53_1.1.0_ga, imx_3.14.28_1.0.0_ga, smarc-imx_3.10.53_1.1.0_ga, smarc-imx_3.14.28_1.0.0_ga

userns: Allow unprivileged users to create new namespaces 

If an unprivileged user has the appropriate capabilities in their
current user namespace allow the creation of new namespaces.

Acked-by: Serge Hallyn <serge.hallyn@canonical.com>
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>

Showing 1 changed file with 3 additions and 2 deletions Side-by-side Diff

... ... @@ -122,6 +122,7 @@
122 122 int copy_namespaces(unsigned long flags, struct task_struct *tsk)
123 123 {
124 124 struct nsproxy *old_ns = tsk->nsproxy;
  125 + struct user_namespace *user_ns = task_cred_xxx(tsk, user_ns);
125 126 struct nsproxy *new_ns;
126 127 int err = 0;
127 128  
... ... @@ -134,7 +135,7 @@
134 135 CLONE_NEWPID | CLONE_NEWNET)))
135 136 return 0;
136 137  
137   - if (!capable(CAP_SYS_ADMIN)) {
  138 + if (!ns_capable(user_ns, CAP_SYS_ADMIN)) {
138 139 err = -EPERM;
139 140 goto out;
140 141 }
... ... @@ -191,7 +192,7 @@
191 192 CLONE_NEWNET | CLONE_NEWPID)))
192 193 return 0;
193 194  
194   - if (!capable(CAP_SYS_ADMIN))
  195 + if (!nsown_capable(CAP_SYS_ADMIN))
195 196 return -EPERM;
196 197  
197 198 *new_nsp = create_new_namespaces(unshare_flags, current,