Re: [libvirt] [RFC PATCH 1/2] LXC: Drop capabilities only if we're not within a user namespace
Am 25.06.2013 22:36, schrieb Daniel P. Berrange:
On Thu, Jun 13, 2013 at 08:02:17PM +0200, Richard Weinberger wrote:
> Dropping capabilities within a user namespace makes no sense
> because any uid 0 process will regain all caps upon execve().
That is true, except for the fact that libvirt has removed the
capabilities from the bounding set too. This prevents them being
regained upon execve.
Are you sure that this applies also for user namespaces?
Thanks,
//richard