From 12bea7a13cd5d9e6fb45407b6d5e8b4c95c082bb Mon Sep 17 00:00:00 2001 From: "Eric W. Biederman" Date: Thu, 17 Nov 2011 01:59:07 -0800 Subject: [PATCH] --- yaml --- r: 305988 b: refs/heads/master c: 973c5914260d75292f71a4729753086b9e863d57 h: refs/heads/master v: v3 --- [refs] | 2 +- trunk/kernel/user_namespace.c | 9 +++++++++ 2 files changed, 10 insertions(+), 1 deletion(-) diff --git a/[refs] b/[refs] index cb99739d11c5..a40a04a490da 100644 --- a/[refs] +++ b/[refs] @@ -1,2 +1,2 @@ --- -refs/heads/master: d0bd6594e286bd6145e04e19e8d3fa2e902cb800 +refs/heads/master: 973c5914260d75292f71a4729753086b9e863d57 diff --git a/trunk/kernel/user_namespace.c b/trunk/kernel/user_namespace.c index c15e533d6bc5..e216e1e8ce84 100644 --- a/trunk/kernel/user_namespace.c +++ b/trunk/kernel/user_namespace.c @@ -11,6 +11,7 @@ #include #include #include +#include static struct kmem_cache *user_ns_cachep __read_mostly; @@ -52,6 +53,14 @@ int create_user_ns(struct cred *new) new->gid = new->egid = new->sgid = new->fsgid = 0; put_group_info(new->group_info); new->group_info = get_group_info(&init_groups); + /* Start with the same capabilities as init but useless for doing + * anything as the capabilities are bound to the new user namespace. + */ + new->securebits = SECUREBITS_DEFAULT; + new->cap_inheritable = CAP_EMPTY_SET; + new->cap_permitted = CAP_FULL_SET; + new->cap_effective = CAP_FULL_SET; + new->cap_bset = CAP_FULL_SET; #ifdef CONFIG_KEYS key_put(new->request_key_auth); new->request_key_auth = NULL;