From: Eric W. Biederman Date: Fri, 14 Dec 2012 16:50:54 +0000 (-0800) Subject: userns: Add a more complete capability subset test to commit_creds X-Git-Tag: v3.8-rc1~63^2~1 X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=aa6d054e5ce94720797ca260392a74dbced56412;p=pandora-kernel.git userns: Add a more complete capability subset test to commit_creds When unsharing a user namespace we reduce our credentials to just what can be done in that user namespace. This is a subset of the credentials we previously had. Teach commit_creds to recognize this is a subset of the credentials we have had before and don't clear the dumpability flag. This allows an unprivileged program to do: unshare(CLONE_NEWUSER); fd = open("/proc/self/uid_map", O_RDWR); Where previously opening the uid_map writable would fail because the the task had been made non-dumpable. Acked-by: Serge Hallyn Signed-off-by: "Eric W. Biederman" --- Reading git-diff-tree failed