[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

Re: [libvirt] [RFC PATCH 1/2] LXC: Drop capabilities only if we're not within a user namespace



Am 25.06.2013 22:36, schrieb Daniel P. Berrange:
> On Thu, Jun 13, 2013 at 08:02:17PM +0200, Richard Weinberger wrote:
>> Dropping capabilities within a user namespace makes no sense
>> because any uid 0 process will regain all caps upon execve().
> 
> That is true, except for the fact that libvirt has removed the
> capabilities from the bounding set too. This prevents them being
> regained upon execve.

Are you sure that this applies also for user namespaces?

Thanks,
//richard


[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]