If only the dynamic part of procfs is mounted (subset=pid), then there is no
need to check if procfs is fully visible to the user in the new user namespace.
Alexey Gladkov (2):
proc: Relax check of mount visibility
Show /proc/self/net only for CAP_NET_ADMIN
fs/namespace.c | 27 ++++++++++++++++-----------
fs/proc/proc_net.c | 8 ++++++++
fs/proc/root.c | 21 +++++++++++++++------
include/linux/fs.h | 1 +
include/linux/proc_fs.h | 1 +
5 files changed, 41 insertions(+), 17 deletions(-)
--
2.25.4