Re: [PATCH] selinux: check CAP_SETFCAP for a particular inode & mapped user

2017-10-09 Thread Paul Moore
On Mon, Oct 9, 2017 at 2:14 PM, Lubomir Rintel wrote: > On Thu, 2017-10-05 at 01:48 -0500, Serge E. Hallyn wrote: >> On Thu, Oct 05, 2017 at 08:16:11AM +0200, Lubomir Rintel wrote: >> > This allows setting "security.capability" xattr by a user that has >> > CAP_SETFCAP in an userns with SELinux. N

Re: [PATCH] selinux: check CAP_SETFCAP for a particular inode & mapped user

2017-10-09 Thread Lubomir Rintel
On Thu, 2017-10-05 at 01:48 -0500, Serge E. Hallyn wrote: > On Thu, Oct 05, 2017 at 08:16:11AM +0200, Lubomir Rintel wrote: > > This allows setting "security.capability" xattr by a user that has > > CAP_SETFCAP in an userns with SELinux. Namespaced capabilities are > > supported, as of commit 8db6c

Re: [PATCH] selinux: check CAP_SETFCAP for a particular inode & mapped user

2017-10-04 Thread Serge E. Hallyn
On Thu, Oct 05, 2017 at 08:16:11AM +0200, Lubomir Rintel wrote: > This allows setting "security.capability" xattr by a user that has > CAP_SETFCAP in an userns with SELinux. Namespaced capabilities are > supported, as of commit 8db6c34f1dbc ("Introduce v3 namespaced file > capabilities"). > > Sign

[PATCH] selinux: check CAP_SETFCAP for a particular inode & mapped user

2017-10-04 Thread Lubomir Rintel
This allows setting "security.capability" xattr by a user that has CAP_SETFCAP in an userns with SELinux. Namespaced capabilities are supported, as of commit 8db6c34f1dbc ("Introduce v3 namespaced file capabilities"). Signed-off-by: Lubomir Rintel --- A casual warning: Please not assume I know wh