summaryrefslogtreecommitdiff
path: root/ipc
diff options
context:
space:
mode:
authorEric W. Biederman <ebiederm@xmission.com>2012-07-26 12:13:20 +0400
committerEric W. Biederman <ebiederm@xmission.com>2012-11-20 16:17:42 +0400
commit142e1d1d5f088e7a38659daca6e84a730967774a (patch)
treee2297a9a77f55bb15a566979c9c5658cff4737f8 /ipc
parentb33c77ef23dd3ec5692c9c0cc739a3f5f0f2baae (diff)
downloadlinux-142e1d1d5f088e7a38659daca6e84a730967774a.tar.xz
userns: Allow unprivileged use of setns.
- Push the permission check from the core setns syscall into the setns install methods where the user namespace of the target namespace can be determined, and used in a ns_capable call. Acked-by: Serge Hallyn <serge.hallyn@canonical.com> Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Diffstat (limited to 'ipc')
-rw-r--r--ipc/namespace.c6
1 files changed, 5 insertions, 1 deletions
diff --git a/ipc/namespace.c b/ipc/namespace.c
index f362298c5ce4..6ed33c05cb66 100644
--- a/ipc/namespace.c
+++ b/ipc/namespace.c
@@ -161,8 +161,12 @@ static void ipcns_put(void *ns)
return put_ipc_ns(ns);
}
-static int ipcns_install(struct nsproxy *nsproxy, void *ns)
+static int ipcns_install(struct nsproxy *nsproxy, void *new)
{
+ struct ipc_namespace *ns = new;
+ if (!ns_capable(ns->user_ns, CAP_SYS_ADMIN))
+ return -EPERM;
+
/* Ditch state from the old ipc namespace */
exit_sem(current);
put_ipc_ns(nsproxy->ipc_ns);