Received-SPF: pass (google.com: domain of linux-kernel+bounces-181127-linux.lists.archive=gmail.com@vger.kernel.org designates 139.178.88.99 as permitted sender) client-ip=139.178.88.99;
Precedence: bulk
Mime-Version: 1.0
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain; charset=UTF-8
Date: Thu, 16 May 2024 16:36:07 +0300
Message-Id: <D1B3XN42A6DR.1RSMLZ6R7VRHT@kernel.org>
Cc: <brauner@kernel.org>, <ebiederm@xmission.com>, "Luis Chamberlain"
 <mcgrof@kernel.org>, "Kees Cook" <keescook@chromium.org>, "Joel Granados"
 <j.granados@samsung.com>, "Serge Hallyn" <serge@hallyn.com>, "Paul Moore"
 <paul@paul-moore.com>, "James Morris" <jmorris@namei.org>, "David Howells"
 <dhowells@redhat.com>, <containers@lists.linux.dev>,
 <linux-kernel@vger.kernel.org>, <linux-fsdevel@vger.kernel.org>,
 <linux-security-module@vger.kernel.org>, <keyrings@vger.kernel.org>
Subject: Re: [PATCH 0/3] Introduce user namespace capabilities
From: "Jarkko Sakkinen" <jarkko@kernel.org>
To: "Ben Boeckel" <me@benboeckel.net>, "Jonathan Calmels"
 <jcalmels@3xx0.net>
References: <20240516092213.6799-1-jcalmels@3xx0.net>
 <ZkYKgNltq2hlBzbx@farprobe>
In-Reply-To: <ZkYKgNltq2hlBzbx@farprobe>

On Thu May 16, 2024 at 4:30 PM EEST, Ben Boeckel wrote:
> On Thu, May 16, 2024 at 02:22:02 -0700, Jonathan Calmels wrote:
> > Jonathan Calmels (3):
> >   capabilities: user namespace capabilities
> >   capabilities: add securebit for strict userns caps
> >   capabilities: add cap userns sysctl mask
> >=20
> >  fs/proc/array.c                 |  9 ++++
> >  include/linux/cred.h            |  3 ++
> >  include/linux/securebits.h      |  1 +
> >  include/linux/user_namespace.h  |  7 +++
> >  include/uapi/linux/prctl.h      |  7 +++
> >  include/uapi/linux/securebits.h | 11 ++++-
> >  kernel/cred.c                   |  3 ++
> >  kernel/sysctl.c                 | 10 ++++
> >  kernel/umh.c                    | 16 +++++++
> >  kernel/user_namespace.c         | 83 ++++++++++++++++++++++++++++++---
> >  security/commoncap.c            | 59 +++++++++++++++++++++++
> >  security/keys/process_keys.c    |  3 ++
> >  12 files changed, 204 insertions(+), 8 deletions(-)
>
> I note a lack of any changes to `Documentation/` which seems quite
> glaring for something with such a userspace visibility aspect to it.
>
> --Ben

Yeah, also in cover letter it would be nice to refresh what is
a bounding set. I had to xref that (recalled what it is), and
then got bored reading the rest :-)

Not exactly in the nutshell cover letter tbh, but maybe the
content in that would be better put to Documentation/

BR, Jarkko