diff options
| author | Eric W. Biederman <ebiederm@xmission.com> | 2011-11-17 01:59:07 -0800 |
|---|---|---|
| committer | Eric W. Biederman <ebiederm@xmission.com> | 2012-04-07 16:55:59 -0700 |
| commit | 973c5914260d75292f71a4729753086b9e863d57 (patch) | |
| tree | b194688d30f2f05debd24605650edba0509bbcad | |
| parent | d0bd6594e286bd6145e04e19e8d3fa2e902cb800 (diff) | |
userns: Start out with a full set of capabilities.
Acked-by: Serge Hallyn <serge.hallyn@canonical.com>
Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>
| -rw-r--r-- | kernel/user_namespace.c | 9 |
1 files changed, 9 insertions, 0 deletions
diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c index c15e533d6bc5..e216e1e8ce84 100644 --- a/kernel/user_namespace.c +++ b/kernel/user_namespace.c @@ -11,6 +11,7 @@ #include <linux/user_namespace.h> #include <linux/highuid.h> #include <linux/cred.h> +#include <linux/securebits.h> static struct kmem_cache *user_ns_cachep __read_mostly; @@ -52,6 +53,14 @@ int create_user_ns(struct cred *new) new->gid = new->egid = new->sgid = new->fsgid = 0; put_group_info(new->group_info); new->group_info = get_group_info(&init_groups); + /* Start with the same capabilities as init but useless for doing + * anything as the capabilities are bound to the new user namespace. + */ + new->securebits = SECUREBITS_DEFAULT; + new->cap_inheritable = CAP_EMPTY_SET; + new->cap_permitted = CAP_FULL_SET; + new->cap_effective = CAP_FULL_SET; + new->cap_bset = CAP_FULL_SET; #ifdef CONFIG_KEYS key_put(new->request_key_auth); new->request_key_auth = NULL; |