From mboxrd@z Thu Jan 1 00:00:00 1970 From: ebiederm-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org (Eric W. Biederman) Subject: Re: [PATCH 1/1] RFC: taking a crack at targeted capabilities Date: Wed, 06 Jan 2010 16:16:35 -0800 Message-ID: References: <20100106062809.GA17064@us.ibm.com> <20100106201725.GA24242@us.ibm.com> <20100106215721.GA5823@us.ibm.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <20100106215721.GA5823-r/Jw6+rmf7HQT0dZR+AlfA@public.gmane.org> (Serge E. Hallyn's message of "Wed\, 6 Jan 2010 15\:57\:21 -0600") List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: containers-bounces-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org Errors-To: containers-bounces-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org To: "Serge E. Hallyn" Cc: Linux Containers List-Id: containers.vger.kernel.org "Serge E. Hallyn" writes: > Quoting Eric W. Biederman (ebiederm-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org): >> "Serge E. Hallyn" writes: >> >> >> - Introduce ns_capable to test for a capability in a non-default >> >> user namespace. >> >> - Teach cap_capable to handle capabilities in a non-default >> >> user namespace. >> > >> > So yeah, I didn't address the whole has_capability junk. Feh. >> >> That just fell out... >> >> > So do you intend to tag all namespaces with the userns which >> > created it? So sys_hostname() can check utsname->uts_ns->creator, >> > and net ioctl SIOCSIFNAME checks struct net->creator? >> >> That is the plan. Add a creator/usernamespace as part of the patches >> to support creating a new namespace without the global CAP_SYS_ADMIN. > > Cool - are you working on that right now, or should I start it myself > if i'm bored and restless tonight? Go for it. I have some things to wrap up before I can do much with this, despite the fact I want to. Eric