"Serge E. Hallyn" [off-list ref] writes:
Quoting Michael Kerrisk (man-pages) (mtk.manpages-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org):
quoted
Hi Eric,
On 07/25/2016 03:18 PM, Eric W. Biederman wrote:
quoted
"Michael Kerrisk (man-pages)" [off-list ref] writes:
quoted
Hi Andrey,
On 07/22/2016 08:25 PM, Andrey Vagin wrote:
Perhaps add "and the caller does not have CAP_SYS_ADMIN" in the initial
user namespace"?
Having looked at that bit of code I don't think capabilities really
have a role to play.
Yes, I caught up with that now. I await to see how this plays out
in the next patch version.
Thanks - that had caught my eye but I hadn't had time to look into the
justification for this. Hiding this kind of thing indeed seems wrong to
me, unless there is a really good justification for it, i.e. a way
to use that info in an exploit.
To avoid breaking checkpoint/restart we need to limit information to the
namespaces the caller is a member of for the user and pid namespaces.
This roughly duplicates the parentage checks in ns_capable.
Conceptually this is the same as limiting .. in a chroot environment.
Eric