diff options
| author | Eric W. Biederman <[email protected]> | 2013-03-13 18:51:49 +0000 |
|---|---|---|
| committer | Linus Torvalds <[email protected]> | 2013-03-13 22:00:20 +0000 |
| commit | e66eded8309ebf679d3d3c1f5820d1f2ca332c71 (patch) | |
| tree | 768e1d799f6d6a4a7f85f48d9e9fc431dc8d017c /net/unix/af_unix.c | |
| parent | futex: fix kernel-doc notation and spello (diff) | |
| download | kernel-e66eded8309ebf679d3d3c1f5820d1f2ca332c71.tar.gz kernel-e66eded8309ebf679d3d3c1f5820d1f2ca332c71.zip | |
userns: Don't allow CLONE_NEWUSER | CLONE_FS
Don't allowing sharing the root directory with processes in a
different user namespace. There doesn't seem to be any point, and to
allow it would require the overhead of putting a user namespace
reference in fs_struct (for permission checks) and incrementing that
reference count on practically every call to fork.
So just perform the inexpensive test of forbidding sharing fs_struct
acrosss processes in different user namespaces. We already disallow
other forms of threading when unsharing a user namespace so this
should be no real burden in practice.
This updates setns, clone, and unshare to disallow multiple user
namespaces sharing an fs_struct.
Cc: [email protected]
Signed-off-by: "Eric W. Biederman" <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
Diffstat (limited to 'net/unix/af_unix.c')
0 files changed, 0 insertions, 0 deletions