[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

Re: [libvirt] [RFC PATCH 1/2] LXC: Drop capabilities only if we're not within a user namespace



On Thu, Jun 13, 2013 at 08:02:17PM +0200, Richard Weinberger wrote:
> Dropping capabilities within a user namespace makes no sense
> because any uid 0 process will regain all caps upon execve().

That is true, except for the fact that libvirt has removed the
capabilities from the bounding set too. This prevents them being
regained upon execve.

Daniel
-- 
|: http://berrange.com      -o-    http://www.flickr.com/photos/dberrange/ :|
|: http://libvirt.org              -o-             http://virt-manager.org :|
|: http://autobuild.org       -o-         http://search.cpan.org/~danberr/ :|
|: http://entangle-photo.org       -o-       http://live.gnome.org/gtk-vnc :|


[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]