Re: [PATCH] Forbid invocation of kexec_load() outside initial PID namespace

From: Eric W. Biederman
Date: Fri Aug 03 2012 - 08:45:55 EST

Next message: Seiichi Ikarashi: "[PATCH] ipc/sem.c: prevent ENOMEM in semop() w/ SEM_UNDO flag"
Previous message: Pavel Emelyanov: "Re: [PATCH v2] futex: mark get_robust_list as deprecated"
In reply to: richard -rw- weinberger: "Re: [PATCH] Forbid invocation of kexec_load() outside initial PID namespace"
Next in thread: Daniel P. Berrange: "Re: [PATCH] Forbid invocation of kexec_load() outside initial PIDnamespace"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

The solution is to use user namespaces and to only test ns_capable on the magic reboot path.

For the 3.7 timeframe that should be a realistic solution.

Eric
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

Next message: Seiichi Ikarashi: "[PATCH] ipc/sem.c: prevent ENOMEM in semop() w/ SEM_UNDO flag"
Previous message: Pavel Emelyanov: "Re: [PATCH v2] futex: mark get_robust_list as deprecated"
In reply to: richard -rw- weinberger: "Re: [PATCH] Forbid invocation of kexec_load() outside initial PID namespace"
Next in thread: Daniel P. Berrange: "Re: [PATCH] Forbid invocation of kexec_load() outside initial PIDnamespace"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]