Quoting Eric W. Biederman ([email protected]): > "Serge E. Hallyn" <[email protected]> writes: > > >> - Introduce ns_capable to test for a capability in a non-default > >> user namespace. > >> - Teach cap_capable to handle capabilities in a non-default > >> user namespace. > > > > So yeah, I didn't address the whole has_capability junk. Feh. > > That just fell out... > > > So do you intend to tag all namespaces with the userns which > > created it? So sys_hostname() can check utsname->uts_ns->creator, > > and net ioctl SIOCSIFNAME checks struct net->creator? > > That is the plan. Add a creator/usernamespace as part of the patches > to support creating a new namespace without the global CAP_SYS_ADMIN.
Cool - are you working on that right now, or should I start it myself if i'm bored and restless tonight? -serge _______________________________________________ Containers mailing list [email protected] https://lists.linux-foundation.org/mailman/listinfo/containers _______________________________________________ Devel mailing list [email protected] https://openvz.org/mailman/listinfo/devel
