Andy Lutomirski 41c21e351e userns: Changing any namespace id mappings should require privileges ...

Changing uid/gid/projid mappings doesn't change your id within the
namespace; it reconfigures the namespace.  Unprivileged programs should
*not* be able to write these files.  (We're also checking the privileges
on the wrong task.)

Given the write-once nature of these files and the other security
checks, this is likely impossible to usefully exploit.

Signed-off-by: Andy Lutomirski <luto@amacapital.net>

2013-04-14 18:11:32 -07:00

23 KiB

Raw Blame History

View Raw