* Documentation patch for namespaced file capabilities
@ 2017-11-20 9:36 ` Michael Kerrisk (man-pages)
0 siblings, 0 replies; 14+ messages in thread
From: Michael Kerrisk (man-pages) @ 2017-11-20 9:36 UTC (permalink / raw)
To: Serge E. Hallyn
Cc: Amir Goldstein, Stefan Berger, Eric W. Biederman,
Linux Containers, lkp, xiaolong.ye, linux-kernel, Mimi Zohar,
Tycho Andersen, James Bottomley, christian.brauner, Vivek Goyal,
LSM List, Casey Schaufler, Linux API, Michael Kerrisk
Hi Serge,
At the moment man-pages lacks documentation of the namespaced file
capability feature that you added with commit
8db6c34f1dbc8e06aa016a9b829b06902c3e1340. Would you be able to send a
patch describing the feature?
Presumably, the patch would be for the capabilities(7) page (or
perhaps for the user_namespaces(7) page, if that seems more
appropriate), As well as documenting the semantics, it would be good
to include an example or two of the notation that is used for the
xattr names.
Presumably also there will be some changes in userspace tools
(setcap/getcap?). Do you know anything about what's happening there?
Cheers,
Michael
--
Michael Kerrisk
Linux man-pages maintainer; http://www.kernel.org/doc/man-pages/
Linux/UNIX System Programming Training: http://man7.org/training/
^ permalink raw reply [flat|nested] 14+ messages in thread
* Documentation patch for namespaced file capabilities
@ 2017-11-20 9:36 ` Michael Kerrisk (man-pages)
0 siblings, 0 replies; 14+ messages in thread
From: Michael Kerrisk (man-pages) @ 2017-11-20 9:36 UTC (permalink / raw)
To: linux-security-module
Hi Serge,
At the moment man-pages lacks documentation of the namespaced file
capability feature that you added with commit
8db6c34f1dbc8e06aa016a9b829b06902c3e1340. Would you be able to send a
patch describing the feature?
Presumably, the patch would be for the capabilities(7) page (or
perhaps for the user_namespaces(7) page, if that seems more
appropriate), As well as documenting the semantics, it would be good
to include an example or two of the notation that is used for the
xattr names.
Presumably also there will be some changes in userspace tools
(setcap/getcap?). Do you know anything about what's happening there?
Cheers,
Michael
--
Michael Kerrisk
Linux man-pages maintainer; http://www.kernel.org/doc/man-pages/
Linux/UNIX System Programming Training: http://man7.org/training/
--
To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
the body of a message to majordomo at vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply [flat|nested] 14+ messages in thread
[parent not found: <CAKgNAkiAeqbD=G6hnExh4cC84nA2mU6xdLzzS0F2x1wviEPgHg-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org>]
* Re: Documentation patch for namespaced file capabilities
[not found] ` <CAKgNAkiAeqbD=G6hnExh4cC84nA2mU6xdLzzS0F2x1wviEPgHg-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org>
@ 2017-11-20 16:03 ` Eric W. Biederman
2017-11-20 16:03 ` Eric W. Biederman
2017-11-29 17:58 ` Serge E. Hallyn
2 siblings, 0 replies; 14+ messages in thread
From: Eric W. Biederman @ 2017-11-20 16:03 UTC (permalink / raw)
To: Michael Kerrisk (man-pages)
Cc: Mimi Zohar, Linux Containers, xiaolong.ye-ral2JQCrhuEAvxtiuMwx3w,
linux-kernel, James Bottomley, LSM List, Linux API,
Casey Schaufler, lkp-JC7UmRfGjtg
"Michael Kerrisk (man-pages)" <mtk.manpages-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org> writes:
> Hi Serge,
>
> At the moment man-pages lacks documentation of the namespaced file
> capability feature that you added with commit
> 8db6c34f1dbc8e06aa016a9b829b06902c3e1340. Would you be able to send a
> patch describing the feature?
>
> Presumably, the patch would be for the capabilities(7) page (or
> perhaps for the user_namespaces(7) page, if that seems more
> appropriate), As well as documenting the semantics, it would be good
> to include an example or two of the notation that is used for the
> xattr names.
>
> Presumably also there will be some changes in userspace tools
> (setcap/getcap?). Do you know anything about what's happening there?
Just a quick summary.
- The capability name does not change.
- From inside a user namespace the capability works as for ``root'' as
existing tools expect. (AKA the capability is mapped into the current
user namespace).
- From outside a user namespace the version of the capability is
incremented, and a uid of the root user in a user namespace is added
at the end in the new version of the capability.
So for the capabilities(7) manpage I would add to the File capablities
section:
Since Kernel v4.14 the kernel supports setting file capabilities inside
a user namespace. In which case an additional uid is stored indicating
the root user of the user namespace the file capabilitity is active in.
When a file is executed and it has a file capability limited to a user
namespace, the kernel takes the uid from the capability and if that uid
matches the uid of the root user of the user namespace or the root user
of an ancestor namespace the capability is applied. Otherwise the
capability is ignored.
Eric
^ permalink raw reply [flat|nested] 14+ messages in thread* Re: Documentation patch for namespaced file capabilities
2017-11-20 9:36 ` Michael Kerrisk (man-pages)
(?)
(?)
@ 2017-11-20 16:03 ` Eric W. Biederman
-1 siblings, 0 replies; 14+ messages in thread
From: Eric W. Biederman @ 2017-11-20 16:03 UTC (permalink / raw)
To: Michael Kerrisk (man-pages)
Cc: Serge E. Hallyn, Amir Goldstein, Stefan Berger, Linux Containers,
lkp-JC7UmRfGjtg, xiaolong.ye-ral2JQCrhuEAvxtiuMwx3w, linux-kernel,
Mimi Zohar, Tycho Andersen, James Bottomley,
christian.brauner-cl+VPiYnx/1AfugRpC6u6w, Vivek Goyal, LSM List,
Casey Schaufler, Linux API
"Michael Kerrisk (man-pages)" <mtk.manpages-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org> writes:
> Hi Serge,
>
> At the moment man-pages lacks documentation of the namespaced file
> capability feature that you added with commit
> 8db6c34f1dbc8e06aa016a9b829b06902c3e1340. Would you be able to send a
> patch describing the feature?
>
> Presumably, the patch would be for the capabilities(7) page (or
> perhaps for the user_namespaces(7) page, if that seems more
> appropriate), As well as documenting the semantics, it would be good
> to include an example or two of the notation that is used for the
> xattr names.
>
> Presumably also there will be some changes in userspace tools
> (setcap/getcap?). Do you know anything about what's happening there?
Just a quick summary.
- The capability name does not change.
- From inside a user namespace the capability works as for ``root'' as
existing tools expect. (AKA the capability is mapped into the current
user namespace).
- From outside a user namespace the version of the capability is
incremented, and a uid of the root user in a user namespace is added
at the end in the new version of the capability.
So for the capabilities(7) manpage I would add to the File capablities
section:
Since Kernel v4.14 the kernel supports setting file capabilities inside
a user namespace. In which case an additional uid is stored indicating
the root user of the user namespace the file capabilitity is active in.
When a file is executed and it has a file capability limited to a user
namespace, the kernel takes the uid from the capability and if that uid
matches the uid of the root user of the user namespace or the root user
of an ancestor namespace the capability is applied. Otherwise the
capability is ignored.
Eric
^ permalink raw reply [flat|nested] 14+ messages in thread
* Re: Documentation patch for namespaced file capabilities
@ 2017-11-20 16:03 ` Eric W. Biederman
0 siblings, 0 replies; 14+ messages in thread
From: Eric W. Biederman @ 2017-11-20 16:03 UTC (permalink / raw)
To: Michael Kerrisk (man-pages)
Cc: Serge E. Hallyn, Amir Goldstein, Stefan Berger, Linux Containers,
lkp, xiaolong.ye, linux-kernel, Mimi Zohar, Tycho Andersen,
James Bottomley, christian.brauner, Vivek Goyal, LSM List,
Casey Schaufler, Linux API
"Michael Kerrisk (man-pages)" <mtk.manpages@gmail.com> writes:
> Hi Serge,
>
> At the moment man-pages lacks documentation of the namespaced file
> capability feature that you added with commit
> 8db6c34f1dbc8e06aa016a9b829b06902c3e1340. Would you be able to send a
> patch describing the feature?
>
> Presumably, the patch would be for the capabilities(7) page (or
> perhaps for the user_namespaces(7) page, if that seems more
> appropriate), As well as documenting the semantics, it would be good
> to include an example or two of the notation that is used for the
> xattr names.
>
> Presumably also there will be some changes in userspace tools
> (setcap/getcap?). Do you know anything about what's happening there?
Just a quick summary.
- The capability name does not change.
- From inside a user namespace the capability works as for ``root'' as
existing tools expect. (AKA the capability is mapped into the current
user namespace).
- From outside a user namespace the version of the capability is
incremented, and a uid of the root user in a user namespace is added
at the end in the new version of the capability.
So for the capabilities(7) manpage I would add to the File capablities
section:
Since Kernel v4.14 the kernel supports setting file capabilities inside
a user namespace. In which case an additional uid is stored indicating
the root user of the user namespace the file capabilitity is active in.
When a file is executed and it has a file capability limited to a user
namespace, the kernel takes the uid from the capability and if that uid
matches the uid of the root user of the user namespace or the root user
of an ancestor namespace the capability is applied. Otherwise the
capability is ignored.
Eric
^ permalink raw reply [flat|nested] 14+ messages in thread
* Re: Documentation patch for namespaced file capabilities
@ 2017-11-20 16:03 ` Eric W. Biederman
0 siblings, 0 replies; 14+ messages in thread
From: Eric W. Biederman @ 2017-11-20 16:03 UTC (permalink / raw)
To: lkp
[-- Attachment #1: Type: text/plain, Size: 1791 bytes --]
"Michael Kerrisk (man-pages)" <mtk.manpages@gmail.com> writes:
> Hi Serge,
>
> At the moment man-pages lacks documentation of the namespaced file
> capability feature that you added with commit
> 8db6c34f1dbc8e06aa016a9b829b06902c3e1340. Would you be able to send a
> patch describing the feature?
>
> Presumably, the patch would be for the capabilities(7) page (or
> perhaps for the user_namespaces(7) page, if that seems more
> appropriate), As well as documenting the semantics, it would be good
> to include an example or two of the notation that is used for the
> xattr names.
>
> Presumably also there will be some changes in userspace tools
> (setcap/getcap?). Do you know anything about what's happening there?
Just a quick summary.
- The capability name does not change.
- From inside a user namespace the capability works as for ``root'' as
existing tools expect. (AKA the capability is mapped into the current
user namespace).
- From outside a user namespace the version of the capability is
incremented, and a uid of the root user in a user namespace is added
at the end in the new version of the capability.
So for the capabilities(7) manpage I would add to the File capablities
section:
Since Kernel v4.14 the kernel supports setting file capabilities inside
a user namespace. In which case an additional uid is stored indicating
the root user of the user namespace the file capabilitity is active in.
When a file is executed and it has a file capability limited to a user
namespace, the kernel takes the uid from the capability and if that uid
matches the uid of the root user of the user namespace or the root user
of an ancestor namespace the capability is applied. Otherwise the
capability is ignored.
Eric
^ permalink raw reply [flat|nested] 14+ messages in thread
* Documentation patch for namespaced file capabilities
@ 2017-11-20 16:03 ` Eric W. Biederman
0 siblings, 0 replies; 14+ messages in thread
From: Eric W. Biederman @ 2017-11-20 16:03 UTC (permalink / raw)
To: linux-security-module
"Michael Kerrisk (man-pages)" <mtk.manpages@gmail.com> writes:
> Hi Serge,
>
> At the moment man-pages lacks documentation of the namespaced file
> capability feature that you added with commit
> 8db6c34f1dbc8e06aa016a9b829b06902c3e1340. Would you be able to send a
> patch describing the feature?
>
> Presumably, the patch would be for the capabilities(7) page (or
> perhaps for the user_namespaces(7) page, if that seems more
> appropriate), As well as documenting the semantics, it would be good
> to include an example or two of the notation that is used for the
> xattr names.
>
> Presumably also there will be some changes in userspace tools
> (setcap/getcap?). Do you know anything about what's happening there?
Just a quick summary.
- The capability name does not change.
- From inside a user namespace the capability works as for ``root'' as
existing tools expect. (AKA the capability is mapped into the current
user namespace).
- From outside a user namespace the version of the capability is
incremented, and a uid of the root user in a user namespace is added
at the end in the new version of the capability.
So for the capabilities(7) manpage I would add to the File capablities
section:
Since Kernel v4.14 the kernel supports setting file capabilities inside
a user namespace. In which case an additional uid is stored indicating
the root user of the user namespace the file capabilitity is active in.
When a file is executed and it has a file capability limited to a user
namespace, the kernel takes the uid from the capability and if that uid
matches the uid of the root user of the user namespace or the root user
of an ancestor namespace the capability is applied. Otherwise the
capability is ignored.
Eric
--
To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
the body of a message to majordomo at vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply [flat|nested] 14+ messages in thread
* Re: Documentation patch for namespaced file capabilities
[not found] ` <CAKgNAkiAeqbD=G6hnExh4cC84nA2mU6xdLzzS0F2x1wviEPgHg-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org>
2017-11-20 16:03 ` Eric W. Biederman
2017-11-20 16:03 ` Eric W. Biederman
@ 2017-11-29 17:58 ` Serge E. Hallyn
2 siblings, 0 replies; 14+ messages in thread
From: Serge E. Hallyn @ 2017-11-29 17:58 UTC (permalink / raw)
To: Michael Kerrisk (man-pages)
Cc: Mimi Zohar, Linux Containers, xiaolong.ye-ral2JQCrhuEAvxtiuMwx3w,
linux-kernel, James Bottomley, LSM List, Eric W. Biederman,
Linux API, Casey Schaufler, lkp-JC7UmRfGjtg
Quoting Michael Kerrisk (man-pages) (mtk.manpages-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org):
> Hi Serge,
>
> At the moment man-pages lacks documentation of the namespaced file
> capability feature that you added with commit
> 8db6c34f1dbc8e06aa016a9b829b06902c3e1340. Would you be able to send a
> patch describing the feature?
Sorry. I'm adding this to my todo list, so I should get to it soon.
> Presumably, the patch would be for the capabilities(7) page (or
> perhaps for the user_namespaces(7) page, if that seems more
> appropriate), As well as documenting the semantics, it would be good
> to include an example or two of the notation that is used for the
> xattr names.
>
> Presumably also there will be some changes in userspace tools
> (setcap/getcap?). Do you know anything about what's happening there?
>
> Cheers,
>
> Michael
>
>
> --
> Michael Kerrisk
> Linux man-pages maintainer; http://www.kernel.org/doc/man-pages/
> Linux/UNIX System Programming Training: http://man7.org/training/
^ permalink raw reply [flat|nested] 14+ messages in thread
* Re: Documentation patch for namespaced file capabilities
2017-11-20 9:36 ` Michael Kerrisk (man-pages)
@ 2017-11-29 17:58 ` Serge E. Hallyn
-1 siblings, 0 replies; 14+ messages in thread
From: Serge E. Hallyn @ 2017-11-29 17:58 UTC (permalink / raw)
To: Michael Kerrisk (man-pages)
Cc: Serge E. Hallyn, Amir Goldstein, Stefan Berger, Eric W. Biederman,
Linux Containers, lkp, xiaolong.ye, linux-kernel, Mimi Zohar,
Tycho Andersen, James Bottomley, christian.brauner, Vivek Goyal,
LSM List, Casey Schaufler, Linux API
Quoting Michael Kerrisk (man-pages) (mtk.manpages@gmail.com):
> Hi Serge,
>
> At the moment man-pages lacks documentation of the namespaced file
> capability feature that you added with commit
> 8db6c34f1dbc8e06aa016a9b829b06902c3e1340. Would you be able to send a
> patch describing the feature?
Sorry. I'm adding this to my todo list, so I should get to it soon.
> Presumably, the patch would be for the capabilities(7) page (or
> perhaps for the user_namespaces(7) page, if that seems more
> appropriate), As well as documenting the semantics, it would be good
> to include an example or two of the notation that is used for the
> xattr names.
>
> Presumably also there will be some changes in userspace tools
> (setcap/getcap?). Do you know anything about what's happening there?
>
> Cheers,
>
> Michael
>
>
> --
> Michael Kerrisk
> Linux man-pages maintainer; http://www.kernel.org/doc/man-pages/
> Linux/UNIX System Programming Training: http://man7.org/training/
^ permalink raw reply [flat|nested] 14+ messages in thread
* Documentation patch for namespaced file capabilities
@ 2017-11-29 17:58 ` Serge E. Hallyn
0 siblings, 0 replies; 14+ messages in thread
From: Serge E. Hallyn @ 2017-11-29 17:58 UTC (permalink / raw)
To: linux-security-module
Quoting Michael Kerrisk (man-pages) (mtk.manpages at gmail.com):
> Hi Serge,
>
> At the moment man-pages lacks documentation of the namespaced file
> capability feature that you added with commit
> 8db6c34f1dbc8e06aa016a9b829b06902c3e1340. Would you be able to send a
> patch describing the feature?
Sorry. I'm adding this to my todo list, so I should get to it soon.
> Presumably, the patch would be for the capabilities(7) page (or
> perhaps for the user_namespaces(7) page, if that seems more
> appropriate), As well as documenting the semantics, it would be good
> to include an example or two of the notation that is used for the
> xattr names.
>
> Presumably also there will be some changes in userspace tools
> (setcap/getcap?). Do you know anything about what's happening there?
>
> Cheers,
>
> Michael
>
>
> --
> Michael Kerrisk
> Linux man-pages maintainer; http://www.kernel.org/doc/man-pages/
> Linux/UNIX System Programming Training: http://man7.org/training/
--
To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
the body of a message to majordomo at vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply [flat|nested] 14+ messages in thread
* Re: Documentation patch for namespaced file capabilities
2017-11-29 17:58 ` Serge E. Hallyn
@ 2017-12-19 15:33 ` Michael Kerrisk (man-pages)
-1 siblings, 0 replies; 14+ messages in thread
From: Michael Kerrisk (man-pages) @ 2017-12-19 15:33 UTC (permalink / raw)
To: Serge E. Hallyn
Cc: Amir Goldstein, Stefan Berger, Eric W. Biederman,
Linux Containers, lkp, xiaolong.ye, linux-kernel, Mimi Zohar,
Tycho Andersen, James Bottomley, christian.brauner, Vivek Goyal,
LSM List, Casey Schaufler, Linux API
Hi Serge,
On 29 November 2017 at 18:58, Serge E. Hallyn <serge@hallyn.com> wrote:
> Quoting Michael Kerrisk (man-pages) (mtk.manpages@gmail.com):
>> Hi Serge,
>>
>> At the moment man-pages lacks documentation of the namespaced file
>> capability feature that you added with commit
>> 8db6c34f1dbc8e06aa016a9b829b06902c3e1340. Would you be able to send a
>> patch describing the feature?
>
> Sorry. I'm adding this to my todo list, so I should get to it soon.
A gentle ping...
Cheers,
Michael
>> Presumably, the patch would be for the capabilities(7) page (or
>> perhaps for the user_namespaces(7) page, if that seems more
>> appropriate), As well as documenting the semantics, it would be good
>> to include an example or two of the notation that is used for the
>> xattr names.
>>
>> Presumably also there will be some changes in userspace tools
>> (setcap/getcap?). Do you know anything about what's happening there?
>>
>> Cheers,
>>
>> Michael
>>
>>
>> --
>> Michael Kerrisk
>> Linux man-pages maintainer; http://www.kernel.org/doc/man-pages/
>> Linux/UNIX System Programming Training: http://man7.org/training/
--
Michael Kerrisk
Linux man-pages maintainer; http://www.kernel.org/doc/man-pages/
Linux/UNIX System Programming Training: http://man7.org/training/
^ permalink raw reply [flat|nested] 14+ messages in thread
* Documentation patch for namespaced file capabilities
@ 2017-12-19 15:33 ` Michael Kerrisk (man-pages)
0 siblings, 0 replies; 14+ messages in thread
From: Michael Kerrisk (man-pages) @ 2017-12-19 15:33 UTC (permalink / raw)
To: linux-security-module
Hi Serge,
On 29 November 2017 at 18:58, Serge E. Hallyn <serge@hallyn.com> wrote:
> Quoting Michael Kerrisk (man-pages) (mtk.manpages at gmail.com):
>> Hi Serge,
>>
>> At the moment man-pages lacks documentation of the namespaced file
>> capability feature that you added with commit
>> 8db6c34f1dbc8e06aa016a9b829b06902c3e1340. Would you be able to send a
>> patch describing the feature?
>
> Sorry. I'm adding this to my todo list, so I should get to it soon.
A gentle ping...
Cheers,
Michael
>> Presumably, the patch would be for the capabilities(7) page (or
>> perhaps for the user_namespaces(7) page, if that seems more
>> appropriate), As well as documenting the semantics, it would be good
>> to include an example or two of the notation that is used for the
>> xattr names.
>>
>> Presumably also there will be some changes in userspace tools
>> (setcap/getcap?). Do you know anything about what's happening there?
>>
>> Cheers,
>>
>> Michael
>>
>>
>> --
>> Michael Kerrisk
>> Linux man-pages maintainer; http://www.kernel.org/doc/man-pages/
>> Linux/UNIX System Programming Training: http://man7.org/training/
--
Michael Kerrisk
Linux man-pages maintainer; http://www.kernel.org/doc/man-pages/
Linux/UNIX System Programming Training: http://man7.org/training/
--
To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
the body of a message to majordomo at vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply [flat|nested] 14+ messages in thread
[parent not found: <20171129175849.GC14545-7LNsyQBKDXoIagZqoN9o3w@public.gmane.org>]
* Re: Documentation patch for namespaced file capabilities
[not found] ` <20171129175849.GC14545-7LNsyQBKDXoIagZqoN9o3w@public.gmane.org>
@ 2017-12-19 15:33 ` Michael Kerrisk (man-pages)
0 siblings, 0 replies; 14+ messages in thread
From: Michael Kerrisk (man-pages) @ 2017-12-19 15:33 UTC (permalink / raw)
To: Serge E. Hallyn
Cc: Mimi Zohar, Linux Containers, xiaolong.ye-ral2JQCrhuEAvxtiuMwx3w,
linux-kernel, James Bottomley, LSM List, Eric W. Biederman,
Linux API, Casey Schaufler, lkp-JC7UmRfGjtg
Hi Serge,
On 29 November 2017 at 18:58, Serge E. Hallyn <serge-A9i7LUbDfNHQT0dZR+AlfA@public.gmane.org> wrote:
> Quoting Michael Kerrisk (man-pages) (mtk.manpages-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org):
>> Hi Serge,
>>
>> At the moment man-pages lacks documentation of the namespaced file
>> capability feature that you added with commit
>> 8db6c34f1dbc8e06aa016a9b829b06902c3e1340. Would you be able to send a
>> patch describing the feature?
>
> Sorry. I'm adding this to my todo list, so I should get to it soon.
A gentle ping...
Cheers,
Michael
>> Presumably, the patch would be for the capabilities(7) page (or
>> perhaps for the user_namespaces(7) page, if that seems more
>> appropriate), As well as documenting the semantics, it would be good
>> to include an example or two of the notation that is used for the
>> xattr names.
>>
>> Presumably also there will be some changes in userspace tools
>> (setcap/getcap?). Do you know anything about what's happening there?
>>
>> Cheers,
>>
>> Michael
>>
>>
>> --
>> Michael Kerrisk
>> Linux man-pages maintainer; http://www.kernel.org/doc/man-pages/
>> Linux/UNIX System Programming Training: http://man7.org/training/
--
Michael Kerrisk
Linux man-pages maintainer; http://www.kernel.org/doc/man-pages/
Linux/UNIX System Programming Training: http://man7.org/training/
^ permalink raw reply [flat|nested] 14+ messages in thread
* Documentation patch for namespaced file capabilities
@ 2017-11-20 9:36 Michael Kerrisk (man-pages)
0 siblings, 0 replies; 14+ messages in thread
From: Michael Kerrisk (man-pages) @ 2017-11-20 9:36 UTC (permalink / raw)
To: Serge E. Hallyn
Cc: Mimi Zohar, Linux Containers, xiaolong.ye-ral2JQCrhuEAvxtiuMwx3w,
linux-kernel, James Bottomley, LSM List, Eric W. Biederman,
Linux API, Casey Schaufler, lkp-JC7UmRfGjtg, Michael Kerrisk
Hi Serge,
At the moment man-pages lacks documentation of the namespaced file
capability feature that you added with commit
8db6c34f1dbc8e06aa016a9b829b06902c3e1340. Would you be able to send a
patch describing the feature?
Presumably, the patch would be for the capabilities(7) page (or
perhaps for the user_namespaces(7) page, if that seems more
appropriate), As well as documenting the semantics, it would be good
to include an example or two of the notation that is used for the
xattr names.
Presumably also there will be some changes in userspace tools
(setcap/getcap?). Do you know anything about what's happening there?
Cheers,
Michael
--
Michael Kerrisk
Linux man-pages maintainer; http://www.kernel.org/doc/man-pages/
Linux/UNIX System Programming Training: http://man7.org/training/
^ permalink raw reply [flat|nested] 14+ messages in thread
end of thread, other threads:[~2017-12-19 15:33 UTC | newest]
Thread overview: 14+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2017-11-20 9:36 Documentation patch for namespaced file capabilities Michael Kerrisk (man-pages)
2017-11-20 9:36 ` Michael Kerrisk (man-pages)
[not found] ` <CAKgNAkiAeqbD=G6hnExh4cC84nA2mU6xdLzzS0F2x1wviEPgHg-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org>
2017-11-20 16:03 ` Eric W. Biederman
2017-11-20 16:03 ` Eric W. Biederman
2017-11-20 16:03 ` Eric W. Biederman
2017-11-20 16:03 ` Eric W. Biederman
2017-11-20 16:03 ` Eric W. Biederman
2017-11-29 17:58 ` Serge E. Hallyn
2017-11-29 17:58 ` Serge E. Hallyn
2017-11-29 17:58 ` Serge E. Hallyn
2017-12-19 15:33 ` Michael Kerrisk (man-pages)
2017-12-19 15:33 ` Michael Kerrisk (man-pages)
[not found] ` <20171129175849.GC14545-7LNsyQBKDXoIagZqoN9o3w@public.gmane.org>
2017-12-19 15:33 ` Michael Kerrisk (man-pages)
-- strict thread matches above, loose matches on Subject: below --
2017-11-20 9:36 Michael Kerrisk (man-pages)
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.