From: ebiederm-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org (Eric W. Biederman) Subject: Re: [PATCH] userns: honour no_new_privs for cap_bset during user ns creation/switch Date: Fri, 22 Dec 2017 08:08:04 -0600 Message-ID: <87o9mqhn3v.fsf@xmission.com> References: <20171221210605.181720-1-zenczykowski@gmail.com> <87wp1foiwa.fsf@xmission.com> <87fu83lfw5.fsf@xmission.com> Mime-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Return-path: In-Reply-To: ("Maciej \=\?utf-8\?Q\?\=C5\=BBenczykowski\=22's\?\= message of "Fri, 22 Dec 2017 02:51:49 +0100") List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: containers-bounces-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org Errors-To: containers-bounces-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org To: Maciej =?utf-8?Q?=C5=BBenczykowski?= Cc: Linux Containers , linux-security-module-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, Mahesh Bandewar , Linux Kernel Mailing List , Willem de Bruijn List-Id: containers.vger.kernel.org TWFjaWVqIMW7ZW5jenlrb3dza2kgPHplbmN6eWtvd3NraUBnbWFpbC5jb20+IHdyaXRlczoKCj4+ IEdvb2QgcG9pbnQgYWJvdXQgQ0FQX0RBQ19PVkVSUklERSBvbiBmaWxlcyB5b3Ugb3duLgo+Pgo+ PiBJIHRoaW5rIHRoZXJlIGlzIGFuIGFyZ3VtZW50IHRoYXQgeW91IGFyZSBwbGF5aW5nIGRhbmdl cm91cyBnYW1lcyB3aXRoCj4+IHRoZSBwZXJtaXNzaW9uIHN5c3RlbSB0aGVyZSwgYXMgaXQgaXNu J3QgZWZmZWN0aXZlbHkgYSBmaWxlIHlvdSBvd24gaWYKPj4geW91IGNhbid0IHJlYWQgaXQsIGFu ZCB5b3UgY2FuJ3QgY2hhbmdlIGl0J3MgcGVybWlzc2lvbnMuCj4KPiBBcHBlbmQtb25seSBmaWxl cyBhcmUgdXNlZnVsIC0gcGFydGljdWxhcmx5IGZvciBsb2dnaW5nLgo+IEl0IGNvdWxkIGFsc28g c2ltcGx5IGJlIGEgbm9uLXJlYWRhYmxlIGZpbGUgb24gYSBSL08gZmlsZXN5c3RlbS4KPgo+PiBH aXZlbiBsaXR0bGUgdGhpbmdzIGxpa2UgdGhhdCBJIGNhbiBjb21wbGV0ZWx5IHNlZSBub19uZXdf cHJpdnMgbWVhbmluZwo+PiB5b3UgY2FuJ3QgY3JlYXRlIGEgdXNlciBuYW1lc3BhY2UuICBUaGF0 IHNlZW1zIGNvbnNpc3RlbnQgd2l0aCB0aGUKPj4gbWVhbmluZyBhbmQgcGhpbG9zb3BoeSBvZiBu b19uZXdfcHJpdnMuICBTbyBzaW1wbGUgaXQgaXMgaGFyZCB0byBnZXQKPj4gd3JvbmcuCj4KPiBZ ZXMsIEkgY291bGQgdG90YWxseSBidXkgdGhlIGFyZ3VtZW50IHRoYXQgbm9fbmV3X3ByaXZzIHNo b3VsZCBwcmV2ZW50Cj4gY3JlYXRpbmcgYSB1c2VyIG5zLgo+Cj4gSG93ZXZlciwgdGhlcmUncyBh bHNvIHNldG5zKCkgYW5kIHRoYXQncyBhIGZhaXIgYml0IGhhcmRlciB0byByZWFzb24gYWJvdXQu Cj4gRW50aXJlbHkgZGVueSBpdD8gIEJ1dCB0aGF0IGFjdHVhbGx5IHNlZW1zIHBvdGVudGlhbGx5 IHVzZWZ1bC4uLgo+IEFsbG93IGl0IGJ1dCBjYXAgaXQ/ICBUaGF0J3Mgd2hhdCB0aGlzIGRvZXMu Li4KPgo+PiBXZSBjb3VsZCBkbyBtb3JlIGNsZXZlciB0aGluZ3MgbGlrZSBwbHVnIHRoaXMgd2hv bGUgaW4gdXNlciBuYW1lc3BhY2VzLAo+PiBhbmQgdGhhdCB3b3VsZCBub3QgaHVydCBteSBmZWVs aW5ncy4KPgo+IFN1cmUsIHRoaXMgcGFydGljdWxhciBvbmUgd291bGRuJ3QgYmUgYWxsIHRoYXQg ZWFzeSBJIHRoaW5rLi4uIGFuZCBob3cKPiBtYW55IHN1Y2ggaG9sZXMgYXJlIHRoZXJlPwo+IEkg Zm91bmQgdGhpcyBwYXJ0aWN1bGFyIG9uZSAqYWZ0ZXIqIHlvdXIgZmlyc3QgcmVwbHkgaW4gdGhp cyB0aHJlYWQuCj4KPj4gSG93ZXZlciB1bmxlc3MgdGhhdCBpcyBvdXIgb25seQo+PiBjaG9pY2Ug dG8gYXZvaWQgYmFkbHkgYnJlYWtpbmcgdXNlcnNwYWNlIEkgd291bGQgaGF2ZSB0byBoYXZlIHRv IGRlcGVuZAo+PiBvbiB1c2VyIG5hbWVzcGFjZXMgYmVpbmcgcGVyZmVjdCBmb3Igbm9fbmV3X3By aXZzIHRvIGJlIGEgcHJvcGVyIGphaWwuCj4KPiBUaGlzIHN0dWZmIGlzIHJpZGljdWxvdXNseSBj b21wbGV4IHRvIGdldCByaWdodCBmcm9tIHVzZXJzcGFjZS4gOi0oCgo+PiBBcyBhIGdlbmVyYWwg cnVsZSB1c2VyIG5hbWVzcGFjZXMgYXJlIHdoZXJlIHdlIHRhY2tsZSB0aGUgc3VidGxlIHNjYXJ5 Cj4+IHRoaW5ncyB0aGF0IHNob3VsZCB3b3JrLCBhbmQgbm9fbmV3X3ByaXZzIGlzIHdoZXJlIHdl IGltcGxlbWVudCBhIHNpbXBsZQo+PiBoYXJkIHRvIGdldCB3cm9uZyBqYWlsLiAgTW9zdCBvZiB0 aGUgdGltZSB0aGUgZWZmZWN0IGlzIHRoZSBzYW1lIHRvIGFuCj4+IG91dHNpZGUgb2JzZXJ2ZXIg KGJvdW5kZWQgcGVybWlzc2lvbnMpLCBidXQgdGhlcmUgaXMgYSByZWFsIGRpZmZlcmVuY2UKPj4g aW4gZGlmZmljdWx0eSBvZiBpbXBsZW1lbnRhdGlvbi4KPgo+IFNvLCB3aGVyZSB0byBub3cuLi4K Pgo+IFdvdWxkIHlvdSBhY2NlcHQgcGF0Y2hlcyB0aGF0Ogo+Cj4gLSBtYWtlIG5vX25ld19wcml2 IGJsb2NrIHVzZXIgbnMgY3JlYXRpb24/Cj4KPiAtIG1ha2Ugbm9fbmV3X3ByaXYgYmxvY2sgdXNl ciBucyB0cmFuc2l0aW9uPwoKWWVzLgoKVGhlIGFwcHJvYWNoIHdpbGwgbmVlZCB0byBiZSByZXRo b3VnaHQgaWYgdGhlcmUgaXMgYW55dGhpbmcgZGVsaWJlcmF0ZWx5CmNvbWJpbmluZyB1c2VyIG5h bWVzcGFjZXMgYW5kIG5vX25ld19wcml2cy4gIEFzIHJlZ3Jlc3Npb25zIGFyZSBhIG5vLW5vLgpT byB3ZSBuZWVkIHdpZGUgc3ByZWFkIHRlc3RpbmcsIHRvIGF2b2lkIHRoYXQuCgpCdXQgYXMgbXVj aCBhcyBwb3NzaWJsZSBJIHdhbnQgbm9fbmV3X3ByaXZzIHRvIGJlIHNpbXBsZSBhbmQgZG9pbmcg aXQncwpqb2IuCgpJIHdpbGwgYWxzbyB0YWtlIGFuZCBlbmNvdXJhZ2UgcGF0Y2hlcyB0aGF0IGNs b3NlIHRoaXMgbWlub3IgcHJpdmlsZWdlCmVzY2FsYXRpb24gZnJvbSB0aGUgdXNlciBuYW1lc3Bh Y2Ugc2lkZS4gIEFzIGlkZWFsbHkgY3JlYXRpbmcgYSB1c2VyCm5hbWVzcGFjZSBzaG91bGQgYmUg YXMgc2FmZSBhcyBub19uZXdfcHJpdnMuCgoKPiBPciBwZXJoYXBzIHdlIGNhbiBhc3N1bWUgdGhh dCBsYWNrIG9mIGNyZWF0ZSBwcml2cyBpcyBzdWZmaWNpZW50LCBhbmQKPiBpZiB0aGVyZSdzIGEg cHJlLWV4aXN0aW5nIHVzZXIgbnMgZm9yIHlvdSB0byBlbnRlciwgdGhlbiB0aGF0J3MKPiBhY2Nl cHRhYmxlLi4uCj4gQWx0aG91Z2ggdGhpcyBpbXBsaWVzIHlvdSBwcm9iYWJseSBhbHdheXMgd2Fu dCB0byBjb21iaW5lIG5vX25ld19wcml2cwo+IHdpdGggYSBsZWFmIHVzZXIgbnMsIG9yIG5vX25l d19wcml2cyBpc24ndCBhbGwgdGhhdCB1c2VmdWwgZm9yIHJvb3QgaW4KPiByb290IG5zLi4uCj4g VGhpcyBhZGRlZCBjb21wbGV4aXR5LCBwcm9iYWJseSBtZWFucyBpdCBzaG91bGQgYmUgYmxvY2tl ZC4uLgoKWWVzLgoKPiAtIGluaGVyaXRzIGJzZXQgYWNyb3NzIHVzZXIgbnMgY3JlYXRpb24vdHJh bnNpdGlvbiBiYXNlZCBvbiBYPwo+IFt0aGlzIGlzIHRoZSBvbmUgd2UgY2FyZSBhYm91dCwgYmVj YXVzZSB0aGVyZSBhcmUgc2ltcGx5IHRvbyBtYW55IGJ1Z3MKPiBpbiB0aGUga2VybmVsIHdydC4g Y2VydGFpbiBjYXBzXQoKVGhhdCB3YXMgbXkgc3VzcGljaW9uLCBhbmQgYXR0YWNrIHN1cmZhY2Ug cmVkdWN0aW9uIGlzIGEgZGlmZmVyZW50CmRpc2N1c3Npb24uICBXb3VsZCBub19uZXdfcHJpdnMg cHJldmVudGluZyBhIHVzZXJucyB0cmFuc2l0aW9uIGJlIGVub3VnaApmb3IgdGhlIGNhc2VzIHlv dSBjYXJlIGFib3V0PwoKT3RoZXJ3aXNlIHRoaXMgaXMgYSBkaWZmZXJlbnQgY29udmVyc2F0aW9u IGJlY2F1c2UgaXQgaXMgbm90IGFib3V0CnNlbWFudGljcyBidXQgYWJvdXQgbWFraW5nIHRoZSBj b2RlIHNhZmVyIHRvIHVzZS4gIEluIGdlbmVyYWwgaWYgY29kZSBpcwpzaW1wbHkgbm90IHNhZmUg dG8gdXNlciBpbiBhIHVzZXIgbmFtZXNwYWNlIEkgd291bGQgcHJlZmVyIHRvIHRpZ2h0ZW4KdGhl IHBlcm1pc3Npb24gY2hlY2tzLCBhbmQganVzdCBub3QgYWxsb3cgdGhhdCBjb2RlLgoKTW9zdGx5 IHdoYXQgSSBoYXZlIHNlZW4gaW4gcHJldmlvdXMgY29udmVyc2F0aW9ucyBpcyBzaW1wbHkgY29u Y2VybnMKYWJvdXQgY29kZSB0aGF0IGlzIG5vdCB1c2VkIG9yIG5lZWRlZCwgYmVpbmcgYSBwcm9i bGVtLgoKPiBYIGNvdWxkIGJlOgo+IC0gYSBuZXcgZmxhZyBzaW1pbGFyIHRvIG5vX25ld19wcml2 Cj4gLSBhIG5ldyBzZWN1cmViaXQgZmxhZyAody9sb2NrYml0KSAgW3Byb3ZpZGVkIHNlY3VyZWJp dHMgc3Vydml2ZSBhCj4gdXNlcm5zIHRyYW5zaXRpb24sIGhhdmVuJ3QgY2hlY2tlZF0KPiAtIG9y IHBlcmhhcHMgYSBuZXcgY2FwYWJpbGl0eQo+IC0gc29tZXRoaW5nIGVsc2U/Cj4KPiBIb3cgZG8g d2UgbWFrZSBmb3J3YXJkIHByb2dyZXNzPwoKV2Ugc3RhcnQgYnkgY2F1c2luZyBub19uZXdfcHJp dnMgdG8gYmxvY2sgdXNlcm5zIGNyZWF0aW9uIGFuZCBlbnRlcmluZy4KCkVyaWMKX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KQ29udGFpbmVycyBtYWlsaW5n IGxpc3QKQ29udGFpbmVyc0BsaXN0cy5saW51eC1mb3VuZGF0aW9uLm9yZwpodHRwczovL2xpc3Rz LmxpbnV4Zm91bmRhdGlvbi5vcmcvbWFpbG1hbi9saXN0aW5mby9jb250YWluZXJz