Re: [PATCH 1/1] RFC: taking a crack at targeted capabilities

[ebiederm-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org (Eric W. Biederman)]

"Serge E. Hallyn" <serue-r/Jw6+rmf7HQT0dZR+AlfA@public.gmane.org> writes:

> Quoting Eric W. Biederman (ebiederm-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org):
>> "Serge E. Hallyn" <serue-r/Jw6+rmf7HQT0dZR+AlfA@public.gmane.org> writes:
>> 
>> >> - Introduce ns_capable to test for a capability in a non-default
>> >>   user namespace.
>> >> - Teach cap_capable to handle capabilities in a non-default
>> >>   user namespace.
>> >
>> > So yeah, I didn't address the whole has_capability junk.  Feh.
>> 
>> That just fell out...
>> 
>> > So do you intend to tag all namespaces with the userns which
>> > created it?  So sys_hostname() can check utsname->uts_ns->creator,
>> > and net ioctl SIOCSIFNAME checks struct net->creator?
>> 
>> That is the plan.  Add a creator/usernamespace as part of the patches
>> to support creating a new namespace without the global CAP_SYS_ADMIN.
>
> Cool - are you working on that right now, or should I start it myself
> if i'm bored and restless tonight?

Go for it.  I have some things to wrap up before I can do much with this,
despite the fact I want to.

Eric