From mboxrd@z Thu Jan 1 00:00:00 1970 From: bugzilla-daemon-590EEB7GvNiWaY/ihj7yzEB+6BGkLq7r@public.gmane.org Subject: [Bug 82531] Nondumpable processes that are sandboxed with CLONE_NEWUSER can be ptraced from outside. Date: Sat, 13 Jun 2015 18:56:57 +0000 Message-ID: References: Mime-Version: 1.0 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: Sender: linux-man-owner-u79uwXL29TY76Z2rM5mHXA@public.gmane.org To: linux-man-u79uwXL29TY76Z2rM5mHXA@public.gmane.org List-Id: linux-man@vger.kernel.org https://bugzilla.kernel.org/show_bug.cgi?id=82531 Jann Horn changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |jann+kernelbugzilla@thejh.n | |et --- Comment #5 from Jann Horn --- This is documented. See user_namespaces.7: 3. When a user namespace is created, the kernel records the effective user ID of the creating process as being the "owner" of the namespace. A process that resides in the parent of the user namespace and whose effective user ID matches the owner of the namespace has all capabilities in the namespace. So, a process outside the namespace with the same EUID as the process that moved itself into a new namespace has CAP_SYS_PTRACE inside the namespace. And as capabilities.7 documents: CAP_SYS_PTRACE * Trace arbitrary processes using ptrace(2); -- You are receiving this mail because: You are watching the assignee of the bug. -- To unsubscribe from this list: send the line "unsubscribe linux-man" in the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org More majordomo info at http://vger.kernel.org/majordomo-info.html