[CFT][PATCH 7/8] userns: Add a knob to disable setgroups on a per user namespace basis

2014-12-09 Thread Eric W. Biederman
- Expose the knob to user space through a proc file /proc//setgroups A value of "deny" means the setgroups system call is disabled in the current processes user namespace and can not be enabled in the future in this user namespace. A value of "allow" means the segtoups system call is ena

Re: [CFT][PATCH 7/8] userns: Add a knob to disable setgroups on a per user namespace basis

2014-12-09 Thread Andy Lutomirski
On Tue, Dec 9, 2014 at 12:42 PM, Eric W. Biederman wrote: > > - Expose the knob to user space through a proc file /proc//setgroups > > A value of "deny" means the setgroups system call is disabled in the > current processes user namespace and can not be enabled in the > future in this user n

Re: [CFT][PATCH 7/8] userns: Add a knob to disable setgroups on a per user namespace basis

2014-12-09 Thread Andy Lutomirski
On Tue, Dec 9, 2014 at 4:04 PM, Eric W.Biederman wrote: > > > On December 9, 2014 4:28:38 PM CST, Andy Lutomirski > wrote: >>On Tue, Dec 9, 2014 at 12:42 PM, Eric W. Biederman >> wrote: >>> >>> - Expose the knob to user space through a proc file >>/proc//setgroups >>> >>> A value of "deny" mea

Re: [CFT][PATCH 7/8] userns: Add a knob to disable setgroups on a per user namespace basis

2014-12-11 Thread Andy Lutomirski
On Thu, Dec 11, 2014 at 5:09 PM, Eric W. Biederman wrote: > ebied...@xmission.com (Eric W. Biederman) writes: > >> Andy Lutomirski writes: >> >>> On Tue, Dec 9, 2014 at 4:04 PM, Eric W.Biederman >>> wrote: On December 9, 2014 4:28:38 PM CST, Andy Lutomirski wrote: >On