diff options
| author | Eric W. Biederman <ebiederm@xmission.com> | 2012-07-26 01:13:20 -0700 |
|---|---|---|
| committer | Eric W. Biederman <ebiederm@xmission.com> | 2012-11-20 04:17:42 -0800 |
| commit | 142e1d1d5f088e7a38659daca6e84a730967774a (patch) | |
| tree | e2297a9a77f55bb15a566979c9c5658cff4737f8 /kernel/utsname.c | |
| parent | b33c77ef23dd3ec5692c9c0cc739a3f5f0f2baae (diff) | |
userns: Allow unprivileged use of setns.
- Push the permission check from the core setns syscall into
the setns install methods where the user namespace of the
target namespace can be determined, and used in a ns_capable
call.
Acked-by: Serge Hallyn <serge.hallyn@canonical.com>
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Diffstat (limited to 'kernel/utsname.c')
| -rw-r--r-- | kernel/utsname.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/kernel/utsname.c b/kernel/utsname.c index 679d97a5d3f..4a9362f9325 100644 --- a/kernel/utsname.c +++ b/kernel/utsname.c @@ -102,8 +102,13 @@ static void utsns_put(void *ns) put_uts_ns(ns); } -static int utsns_install(struct nsproxy *nsproxy, void *ns) +static int utsns_install(struct nsproxy *nsproxy, void *new) { + struct uts_namespace *ns = new; + + if (!ns_capable(ns->user_ns, CAP_SYS_ADMIN)) + return -EPERM; + get_uts_ns(ns); put_uts_ns(nsproxy->uts_ns); nsproxy->uts_ns = ns; |