Re: [PATCH v5 1/5] userns: record how far up CAP_SETFCAP reaches
flat view
From: sashiko-bot@kernel.org
Date: 2026-10-23 16:44:45
create_user_ns() records in ns->parent_could_setfcap whether the creator had CAP_SETFCAP in its effective set, and verify_root_map() trusts that when a task in the new namespace maps the parent's uid 0. A bool only describes the parent, though. File capabilities belong to the kuid of a root user, and a namespace that maps the parent's uid 0 shares that kuid with the parent and possibly with ancestors further up, so what matters is how far up the creator's CAP_SETFCAP counted. Replace the bool with ns->setfcap_level: CAP_SETFCAP held in the namespace counts there and in its ancestors up to the one at that ->level. cap_setfcap_level() computes it from the creator's cred. A creator that holds CAP_SETFCAP passes on the setfcap_level of its own namespace, one that doesn't gets the new namespace's own level, and the initial namespace has 0. verify_root_map() keeps checking the same condition: the bool was false exactly when the level is the namespace's own. No functional change. Reviewed-by: Bradley Morgan <redacted> Assisted-by: LLM Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Sashiko has reviewed this patch and found no issues. -- Sashiko AI review · https://sashiko.dev/#/patchset/20261023-b4-setfcap-userns-v5-0-0620223be951@toxicpanda.com?part=1