On Tue, Aug 27, 2013 at 02:46:27PM -0700, Eric W. Biederman wrote: > > Don't allow mounting sysfs unless the caller has CAP_SYS_ADMIN rights > over the net namespace. The principle here is if you create or have > capabilities over it you can mount it, otherwise you get to live with > what other people have mounted. > > Instead of testing this with a straight forward ns_capable call, > perform this check the long and torturous way with kobject helpers, > this keeps direct knowledge of namespaces out of sysfs, and preserves > the existing sysfs abstractions. > > Signed-off-by: "Eric W. Biederman" <ebied...@xmission.com>
Odd, but makes sense. Acked-by: Greg Kroah-Hartman <gre...@linuxfoundation.org> -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
