Re: [PATCH ] Fix capability check to allow privileged CLONE_NEWUSER from nested user namespaces

Quoting Srivatsa S. Bhat (sriva...@csail.mit.edu): > From: Srivatsa S. Bhat > > The existing patch which disallows unprivileged CLONE_NEWUSER applies > the check for CAP_SYS_ADMIN capability on the 'init_user_ns' > namespace, which is not entirely correct. Consider the following sequence: > > 1.

Bug#603944: Updated patch

Here is a patch (against the ubuntu package, just as example) which instead of doing a dumb retry loop, waits for udev. === modified file 'debian/changelog' --- debian/changelog2010-04-26 15:17:47 + +++ debian/changelog2010-12-08 21:44:32 + @@ -1,3 +1,15 @@ +initramfs-tools (0.92bu

Bug#603944: retry mounting of root

Package: initramfs-tools Version: 0.98 When using multipath, it is possible that mountroot() will race with udev's renaming of /dev/disk/by-uuid/{rootfs-uuid} from /dev/sd?? to /dev/mapper/something. After multipath has grabbed the /dev/sd?? and until udev completes the rename, mounting /dev/disk