Re: [PATCH v2] userns: Disallow setgroups unless the gid_map writer is privileged

On Tue, Dec 2, 2014 at 11:45 AM, Eric W. Biederman wrote: > Andy Lutomirski writes: > >> On Tue, Dec 2, 2014 at 4:09 AM, Eric W. Biederman >> wrote: >>> Andy Lutomirski writes: >>> Classic unix permission checks have an interesting feature. The group permissions for a file can be se

Re: [PATCH v2] userns: Disallow setgroups unless the gid_map writer is privileged

Andy Lutomirski writes: > On Tue, Dec 2, 2014 at 4:09 AM, Eric W. Biederman > wrote: >> Andy Lutomirski writes: >> >>> Classic unix permission checks have an interesting feature. The >>> group permissions for a file can be set to less than the other >>> permissions on a file. Occasionally th

Re: [PATCH v2] userns: Disallow setgroups unless the gid_map writer is privileged

On Tue, Dec 2, 2014 at 4:09 AM, Eric W. Biederman wrote: > Andy Lutomirski writes: > >> Classic unix permission checks have an interesting feature. The >> group permissions for a file can be set to less than the other >> permissions on a file. Occasionally this is used deliberately to >> give a

Re: [PATCH v2] userns: Disallow setgroups unless the gid_map writer is privileged

Andy Lutomirski writes: > Classic unix permission checks have an interesting feature. The > group permissions for a file can be set to less than the other > permissions on a file. Occasionally this is used deliberately to > give a certain group of users fewer permissions than the default. > > U

[PATCH v2] userns: Disallow setgroups unless the gid_map writer is privileged

Classic unix permission checks have an interesting feature. The group permissions for a file can be set to less than the other permissions on a file. Occasionally this is used deliberately to give a certain group of users fewer permissions than the default. User namespaces break this usage. Gro