[PATCH 5/6] user namespaces: refuse create in other user_ns
serue at us.ibm.com
Thu Jul 24 04:37:43 PDT 2008
Refuse writing to a directory in another user_ns. We can't
support file creation because we wouldn't know who should own
the file. This refuses file deletion as well - which I think
is the sensible thing to do.
File writing is still allowed if the 'user other' permissions
include write. That again probably makes sense for logging
Signed-off-by: Serge Hallyn <serue at us.ibm.com>
fs/namei.c | 6 ++++++
1 files changed, 6 insertions(+), 0 deletions(-)
diff --git a/fs/namei.c b/fs/namei.c
index adf5f1b..b39a990 100644
@@ -213,6 +213,12 @@ int generic_permission(struct inode *inode, int mask,
+ * Can't write to a directory in another user_ns
+ * We wouldn't know who to make the owner!
+ if (!same_userns && S_ISDIR(inode->i_mode) && (mask&MAY_WRITE))
+ return -EACCES;
* If the DACs are ok we don't need any capability check.
if (((mode & mask & (MAY_READ|MAY_WRITE|MAY_EXEC)) == mask))
More information about the Containers