tree 6344dc4715a85383f6492a4102ae406c6b86d79d
parent c37bbb0fdcc01610fd55604eb6927210a1d20044
author Serge E. Hallyn <serue@us.ibm.com> 1228331853 -0600
committer James Morris <jmorris@namei.org> 1228688187 +1100

user namespaces: require cap_set{ug}id for CLONE_NEWUSER

While ideally CLONE_NEWUSER will eventually require no
privilege, the required permission checks are currently
not there.  As a result, CLONE_NEWUSER has the same effect
as a setuid(0)+setgroups(1,"0").  While we already require
CAP_SYS_ADMIN, requiring CAP_SETUID and CAP_SETGID seems
appropriate.

Signed-off-by: Serge E. Hallyn <serue@us.ibm.com>
Acked-by: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: James Morris <jmorris@namei.org>