Re: [PATCH 4/5] capabilities: limit fscaps to where CAP_SETFCAP reaches
flat view
From: sashiko-bot@kernel.org
Date: 2026-10-06 15:53:56
Commit db2e718a4798 ("capabilities: require CAP_SETFCAP to map uid 0")
keeps a root process without CAP_SETFCAP from creating a user namespace
that maps uid 0, in which it could attach capabilities to a file that are
then honoured outside. It does not have to create one, though. Any
namespace will do that maps uid 0 and that it may enter, and it may enter
all those that were created by uid 0:
task A: uid 0, full caps task B: uid 0, no CAP_SETFCAP
unshare(CLONE_NEWUSER)
write "0 0 1" to uid_map, gid_map
setns(A's user ns)
full capability set
setxattr(file, "security.capability")
rootid = kuid 0
(back in the initial namespace)
[ ... ]
own namespaces. The rest gets -EPERM.
Fixes: 8db6c34f1dbc ("Introduce v3 namespaced file capabilities")
Assisted-by: LLM
Signed-off-by: Josef Bacik <josef@toxicpanda.com>Sashiko has reviewed this patch and found no issues. It looks great! -- Sashiko AI review · https://sashiko.dev/#/patchset/20261006-b4-setfcap-userns-v1-0-f47e7ed66072@toxicpanda.com?part=4