From: ebiederm@xmission.com (Eric W. Biederman)
To: mtk.manpages@gmail.com
Cc: "Serge Hallyn" <serue@us.ibm.com>,
       "Subrata Modak" <subrata@linux.vnet.ibm.com>,
       lkml <linux-kernel@vger.kernel.org>, linux-man@vger.kernel.org,
       clg@fr.ibm.com, herbert@13thfloor.at, dev@sw.ru
References: <cfd18e0f0811191204r4ccaeaf4m4145e67f408543e0@mail.gmail.com>
Date: Wed, 19 Nov 2008 17:41:21 -0800
In-Reply-To: <cfd18e0f0811191204r4ccaeaf4m4145e67f408543e0@mail.gmail.com>
	(Michael Kerrisk's message of "Wed, 19 Nov 2008 15:04:22 -0500")
Message-ID: <m1vdujdvi6.fsf@frodo.ebiederm.org>
User-Agent: Gnus/5.110006 (No Gnus v0.6) Emacs/21.4 (gnu/linux)
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Subject: Re: Current state of CLONE_NEWUSER?
Sender: linux-kernel-owner@vger.kernel.org
Content-Length: 1158
Lines: 29

"Michael Kerrisk" <mtk.manpages@googlemail.com> writes:

> Hi Serge,
>
> What is the current status of CLONE_NEWUSER?  I'm currently trying to
> test this flag in preparation for documenting it in the clone(2) man
> page, but am running into an ENOMEM error from the clone() call, which
> seems to occur after a failure in kobject_init_and_add() in the
> following call sequence:
>
> clone_user_ns() --> alloc_uid() --> uids_user_create() -->
> kobject_init_and_add()
>
> Are there already some test programs somewhere?  Is there any
> documentation already available for this flag?

This code is definitely still under development.

When complete it should be able to create a new uid namespace,
as an unprivileged user.  Creating a new process with uid == gid == 0.
Have a full set of caps.  And have permission to do nothing on the system
except read world readable files and write world writable files.

Eric
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/