[PATCH 0/14] user namespaces v2: continue targetting capabilities
flat view
From: Serge Hallyn <serge@hallyn.com>
Date: 2011-07-26 18:58:33
Also in:
lkml
Subsystem:
audit subsystem, block layer, capabilities, device-mapper (lvm), documentation, drbd driver, ethernet bridge, exec & binfmt api, elf, filesystems (vfs and infrastructure), framebuffer layer, ipvs, keys/keyrings, memory management - core, netfilter, networking [general], networking [ipsec], networking [ipv4/ipv6], networking [sockets], packet sockets, scheduler, scsi subsystem, security subsystem, selinux security module, staging subsystem, the rest · Maintainers:
Paul Moore, Eric Paris, Jens Axboe, Serge Hallyn, Alasdair Kergon, Mike Snitzer, Mikulas Patocka, Benjamin Marzinski, Jonathan Corbet, Philipp Reisner, Lars Ellenberg, Christoph Böhmwalder, Nikolay Aleksandrov, Ido Schimmel, Kees Cook, Alexander Viro, Christian Brauner, Helge Deller, Simon Horman, Julian Anastasov, David Howells, Jarkko Sakkinen, Andrew Morton, David Hildenbrand, Pablo Neira Ayuso, Florian Westphal, "David S. Miller", Eric Dumazet, Jakub Kicinski, Paolo Abeni, Steffen Klassert, Herbert Xu, David Ahern, Kuniyuki Iwashima, Willem de Bruijn, Willem de Bruijn, Ingo Molnar, Peter Zijlstra, Juri Lelli, Vincent Guittot, "James E.J. Bottomley", "Martin K. Petersen", James Morris, Stephen Smalley, Greg Kroah-Hartman, Linus Torvalds
Status: Pending, 1 of 14 reviewed.
Hi, here is a set of patches to continue targetting capabilities where appropriate. This set goes about as far as is possible without making the VFS user namespace aware, meaning that the VFS can provide a namespaced view of userids, i.e init_user_ns sees file owner 500, while child user ns sees file owner 0 or 1000. (There are a few other things, like siginfos, which can be addressed before we address the VFS). With this set applied, you can create and configure veth netdevs if your user namespace owns your network namespace (and you are privileged), but not otherwise. Some simple testcases can be found at https://code.launchpad.net/~serge-hallyn/+junk/usernstests with packages at https://launchpad.net/~serge-hallyn/+archive/userns-natty Feedback very much appreciated. Changes since v1: documentation: incorporate feedback on user_namespaces.txt netlink_capable: use sock_net() instead of ifdefs