Re: [PATCH 0/2] sysctl: allow CLONE_NEWUSER to be disabled

[Eric W. Biederman]

Kees Cook <keescook@xxxxxxxxxxxx> writes:
>
> Well, I don't know about less weird, but it would leave a unneeded
> hole in the permission checks.

To be clear the current patch has my:

Nacked-by: "Eric W. Biederman" <ebiederm@xxxxxxxxxxxx>

The code is buggy, and poorly thought through.  Your lack of interest in
fixing the bugs in your patch is distressing.

So broken code, not willing to fix.  No. We are not merging this sysctl.

Eric