Re: [PATCH] Forbid invocation of kexec_load() outside initial PID namespace

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

On Fri, Aug 03, 2012 at 05:45:40AM -0700, Eric W. Biederman wrote:
> The solution is to use user namespaces and to only test ns_capable on the magic reboot path.
> For the 3.7 timeframe that should be a realistic solution.

Hmm, that would imply that if LXC wants to allow reboot()/CAP_SYS_BOOT
they will be forced to use CLONE_NEWUSER. I was rather looking for a way
to allow the container to keep CAP_SYS_BOOT, without also mandating use
of user namespaces.

|:      -o- :|
|:              -o-    :|
|:       -o- :|
|:       -o- :|
Containers mailing list

[Cgroups]     [Netdev]     [Linux Wireless]     [Kernel Newbies]     [Memory]     [Security]     [Linux for Hams]     [Netfilter]     [Bugtraq]     [Photo]     [Yosemite]     [Yosemite Forum]     [MIPS Linux]     [ARM Linux]     [Linux RAID]     [Linux Admin]     [Find Someone Nice]     [Samba]     [Video 4 Linux]     [Computer Add-ons]

Powered by Linux