From: Eric W. Biederman Date: Wed, 13 Mar 2013 18:51:49 +0000 (-0700) Subject: userns: Don't allow CLONE_NEWUSER | CLONE_FS X-Git-Tag: v3.9-rc3~20 X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=e66eded8309ebf679d3d3c1f5820d1f2ca332c71;p=pandora-kernel.git userns: Don't allow CLONE_NEWUSER | CLONE_FS Don't allowing sharing the root directory with processes in a different user namespace. There doesn't seem to be any point, and to allow it would require the overhead of putting a user namespace reference in fs_struct (for permission checks) and incrementing that reference count on practically every call to fork. So just perform the inexpensive test of forbidding sharing fs_struct acrosss processes in different user namespaces. We already disallow other forms of threading when unsharing a user namespace so this should be no real burden in practice. This updates setns, clone, and unshare to disallow multiple user namespaces sharing an fs_struct. Cc: stable@vger.kernel.org Signed-off-by: "Eric W. Biederman" Signed-off-by: Linus Torvalds --- Reading git-diff-tree failed