Skip to content

L
lxc
Switch branch/tag
  1. 22 Nov, 2016 35 commits
  3. 21 Nov, 2016 3 commits
  5. 20 Nov, 2016 2 commits
    • Merge pull request #1308 from brauner/2016-11-20/use_ns_info_struct · b8ca2bc7
      Stéphane Graber authored 
      use ns info struct and always attach to user namespace first
    • namespace: always attach to user namespace first · 29ed9c13
      Christian Brauner authored 
      Move the user namespace at the first position in the array so that we always
attach to it first when iterating over the struct and using setns() to switch
namespaces. This especially affects lxc_attach(): Suppose you cloned a new user
namespace and mount namespace as an unprivileged user on the host and want to
setns() to the mount namespace. This requires you to attach to the user
namespace first otherwise the kernel will fail this check:

    if (!ns_capable(mnt_ns->user_ns, CAP_SYS_ADMIN) ||
        !ns_capable(current_user_ns(), CAP_SYS_CHROOT) ||
        !ns_capable(current_user_ns(), CAP_SYS_ADMIN))
    	return -EPERM;

in

    linux/fs/namespace.c:mntns_install().
Signed-off-by: 's avatarChristian Brauner <christian.brauner@canonical.com>