Re: [PATCH v2 1/2] tiocsti-restrict : Add owner user namespace to tty_struct

2017-04-23 Thread Jann Horn
On Sun, Apr 23, 2017 at 10:23 PM, Matt Brown wrote: > On 04/23/2017 01:02 PM, Jann Horn wrote: >> >> On Sun, Apr 23, 2017 at 9:24 AM, Matt Brown wrote: >>> >>> This patch adds struct user_namespace *owner_user_ns to the tty_struct. >>> Then it is set to current_user_ns() in the alloc_tty_struct f

Re: [PATCH v2 1/2] tiocsti-restrict : Add owner user namespace to tty_struct

2017-04-23 Thread Matt Brown
On 04/23/2017 01:02 PM, Jann Horn wrote: On Sun, Apr 23, 2017 at 9:24 AM, Matt Brown wrote: This patch adds struct user_namespace *owner_user_ns to the tty_struct. Then it is set to current_user_ns() in the alloc_tty_struct function. This is done to facilitate capability checks against the ori

Re: [PATCH v2 1/2] tiocsti-restrict : Add owner user namespace to tty_struct

2017-04-23 Thread Jann Horn
On Sun, Apr 23, 2017 at 9:24 AM, Matt Brown wrote: > This patch adds struct user_namespace *owner_user_ns to the tty_struct. > Then it is set to current_user_ns() in the alloc_tty_struct function. > > This is done to facilitate capability checks against the original user > namespace that allocated

[PATCH v2 1/2] tiocsti-restrict : Add owner user namespace to tty_struct

2017-04-23 Thread Matt Brown
This patch adds struct user_namespace *owner_user_ns to the tty_struct. Then it is set to current_user_ns() in the alloc_tty_struct function. This is done to facilitate capability checks against the original user namespace that allocated the tty. E.g. ns_capable(tty->owner_user_ns,CAP_SYS_ADMIN)