Re: [PATCH 1/1] RFC: taking a crack at targeted capabilities

["Serge E. Hallyn" <serue-r/Jw6+rmf7HQT0dZR+AlfA@public.gmane.org>]

Quoting Eric W. Biederman (ebiederm-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org):
> "Serge E. Hallyn" <serue-r/Jw6+rmf7HQT0dZR+AlfA@public.gmane.org> writes:
> 
> >> - Introduce ns_capable to test for a capability in a non-default
> >>   user namespace.
> >> - Teach cap_capable to handle capabilities in a non-default
> >>   user namespace.
> >
> > So yeah, I didn't address the whole has_capability junk.  Feh.
> 
> That just fell out...
> 
> > So do you intend to tag all namespaces with the userns which
> > created it?  So sys_hostname() can check utsname->uts_ns->creator,
> > and net ioctl SIOCSIFNAME checks struct net->creator?
> 
> That is the plan.  Add a creator/usernamespace as part of the patches
> to support creating a new namespace without the global CAP_SYS_ADMIN.

Cool - are you working on that right now, or should I start it myself
if i'm bored and restless tonight?

-serge