Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b33c77ef authored by Eric W. Biederman's avatar Eric W. Biederman
Browse files

userns: Allow unprivileged users to create new namespaces 



If an unprivileged user has the appropriate capabilities in their
current user namespace allow the creation of new namespaces.

Acked-by: default avatarSerge Hallyn <serge.hallyn@canonical.com>
Signed-off-by: default avatar"Eric W. Biederman" <ebiederm@xmission.com>
parent 37657da3

kernel/nsproxy.c

+3 −2
Original line number Diff line number Diff line
@@ -122,6 +122,7 @@ static struct nsproxy *create_new_namespaces(unsigned long flags, 
int copy_namespaces(unsigned long flags, struct task_struct *tsk)

{

	struct nsproxy *old_ns = tsk->nsproxy;

	struct user_namespace *user_ns = task_cred_xxx(tsk, user_ns);

	struct nsproxy *new_ns;

	int err = 0;
@@ -134,7 +135,7 @@ int copy_namespaces(unsigned long flags, struct task_struct *tsk) 
				CLONE_NEWPID | CLONE_NEWNET)))

		return 0;



	if (!capable(CAP_SYS_ADMIN)) {

	if (!ns_capable(user_ns, CAP_SYS_ADMIN)) {

		err = -EPERM;

		goto out;

	}
@@ -191,7 +192,7 @@ int unshare_nsproxy_namespaces(unsigned long unshare_flags, 
			       CLONE_NEWNET | CLONE_NEWPID)))

		return 0;



	if (!capable(CAP_SYS_ADMIN))

	if (!nsown_capable(CAP_SYS_ADMIN))

		return -EPERM;



	*new_nsp = create_new_namespaces(unshare_flags, current,