leandrof/linux
1
0
Fork 0
forked from Minki/linux
Code Issues Pull Requests Packages Projects Releases Wiki Activity

userns: Start out with a full set of capabilities.

Browse Source 
Acked-by: Serge Hallyn <serge.hallyn@canonical.com>
Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>
This commit is contained in:
Eric W. Biederman 2011-11-17 01:59:07 -08:00
parent d0bd6594e2
commit 973c591426
1 changed files with 9 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
kernel/user_namespace.c
View File

@ -11,6 +11,7 @@
#include <linux/user_namespace.h> #include <linux/user_namespace.h>
#include <linux/highuid.h> #include <linux/highuid.h>
#include <linux/cred.h> #include <linux/cred.h>
#include <linux/securebits.h>
static struct kmem_cache *user_ns_cachep __read_mostly; static struct kmem_cache *user_ns_cachep __read_mostly;
@ -52,6 +53,14 @@ int create_user_ns(struct cred *new)
new->gid = new->egid = new->sgid = new->fsgid = 0; new->gid = new->egid = new->sgid = new->fsgid = 0;
put_group_info(new->group_info); put_group_info(new->group_info);
new->group_info = get_group_info(&init_groups); new->group_info = get_group_info(&init_groups);
/* Start with the same capabilities as init but useless for doing
* anything as the capabilities are bound to the new user namespace.
*/
new->securebits = SECUREBITS_DEFAULT;
new->cap_inheritable = CAP_EMPTY_SET;
new->cap_permitted = CAP_FULL_SET;
new->cap_effective = CAP_FULL_SET;
new->cap_bset = CAP_FULL_SET;
#ifdef CONFIG_KEYS #ifdef CONFIG_KEYS
key_put(new->request_key_auth); key_put(new->request_key_auth);
new->request_key_auth = NULL; new->request_key_auth = NULL;