Merge branch 'proc-per-ns'

Browse source

Dmitry Torokhov says:

====================
Make /proc per net namespace objects belong to container

Currently [almost] all /proc objects belong to the global root, even if
data belongs to a given namespace within a container and (at least for
sysctls) we work around permssions checks to allow container's root to
access the data.

This series changes ownership of net namespace /proc objects
(/proc/net/self/* and /proc/sys/net/*) to be container's root and not
global root when there exists mapping for container's root in user
namespace.

This helps when running Android CTS in a container, but I think it makes
sense regardless.

Changes from V1:

- added fix for crash when !CONFIG_NET_NS (new patch #1)
- addressed Eric'c comments for error handling style in patch #3 and
  added his Ack
- adjusted patch #2 to use the same style of erro handling
- sent out as series instead of separate patches
====================

Signed-off-by: David S. Miller <davem@davemloft.net>

...

This commit is contained in:

David S. Miller 2016-08-14 21:09:11 -07:00

parent d16d9d2ad7 e79c6a4fc9

commit a878c02017

6 changed files with 61 additions and 13 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

2

fs/proc/generic.c

View file

13

fs/proc/proc_net.c

View file

5

fs/proc/proc_sysctl.c

View file

4

include/linux/sysctl.h

View file

21

net/core/net_namespace.c

View file

29

net/sysctl_net.c

View file