Ready for 3.73

Removed trailing white space at end of lines

clone.2, flock.2, getpid.2, getunwind.2, mount.2, reboot.2, semop.2, seteuid.2, setgid.2, setns.2, setresuid.2, setreuid.2, setuid.2, uname.2, unshare.2, clock.3, drand48.3, proc.5, capabilities.7, credentials.7, mq_overview.7, namespaces.7, pid_namespaces.7, svipc.7, user_namespaces.7: tstamp

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

Changes: Ready for 3.73

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

clone.2: srcfix

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

namespaces.7, pid_namespaces.7, user_namespaces.7: srcfix: Add LICENSE_START tag

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

fcntl.2: tfix

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

setns.2: Add pointer to user_namespaces(7)

Add pointer to user_namespaces(7) for details on interactions
of user and mount namespaces

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

setns.2: ffix

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

setns.2: tfix

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

setns.2: tfix

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

namespaces.7: tfix

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

pid_namespaces.7: ffix

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

user_namespaces.7: spfix

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

unshare.2: Note flags implied by CLONE_THREAD and CLONE_VM

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

user_namespaces.7: wfix

Reported-by: Eric W. Biederman <ebiederm@xmission.com>
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

user_namespaces.7: Clarify the meaning of "Mounts that come as a single unit"

Quoting Eric Biederman:

The importance of [mounts coming across as a dingle unit] is [to]
allow the global root to mount over things and not have to worry
that someone from a user namespace root can peek underneath.

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

mount.2: Clarify use of 'mountflags' and 'data' for MS_REMOUNT

Quoting Eric Biederman:

One thing that has come up recently (in 3 separate
implementations) is that mount(MS_REMOUNT|...,...) must include
all of the mount flags that need to be preserved.   People
creating read-only bind mounts tend to miss that and the locked
flags in mount namespaces.  That issue was flushed out now that
the kernel is now not allowing most mount flags to be cleared in
mount namespaces.  The interface is non-intuitive and we should
at least document the weirdness.

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

user_namespaces.7: Additions from Andy Lutomirski

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

user_namespaces.7: Improvements from Andy Lutomirski

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

user_namespaces.7: Add "Restrictions on mount namespaces" section

Light edits by mtk

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

user_namespaces.7: Only single-threaded processes can join another user namespace

Reported-by: Eric W. Biederman <ebiederm@xmission.com>
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

namespaces.7: wfix

Reported-by: Vitaly Rybnikov <frodox@zoho.com>
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

user_namespaces.7: Improve discussion of handling of capabilities during execve(2)

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

user_namespaces.7: srcfix

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

namespaces.7: Add table of namespaces to top of page

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

namespaces.7: tfix

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

namespaces.7: tfix

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

namespaces.7: tfix

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

user_namespaces.7: Say a little less about execve(2) and user ID mappings

The existing discussion under user and group ID mappings
probably suffices.

Reported-by: Eric W. Biederman <ebiederm@xmission.com>
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

user_namespaces.7: srcfix

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

user_namespaces.7: Note that user namespaces isolate the root directory

Reported-by: Eric W. Biederman <ebiederm@xmission.com>
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

user_namespaces.7: XFS support for user namespaces was added in Linux 3.11

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

user_namespaces.7: Rework text on filesystem support for user namespaces

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

user_namespaces.7: srcfix

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

user_namespaces.7: Remove a confused sentence

Reported-by: Eric W. Biederman <ebiederm@xmission.com>
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

setns.2: ERRORS: Add EINVAL for two cases of joining a new user namespace

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

unshare.2: Add kernel version number for text on CLONE_NEWUSER implying CLONE_FS

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

clone.2: Document EPERM error when using CLONE_NEWUSER from chrooted caller

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

unshare.2: Document EPERM error when using CLONE_NEWUSER from chrooted caller

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

unshare.2: Document EUSERS error

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

clone.2: Document EUSERS error

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

user_namespaces.7: Document maximum nesting depth for user namespaces

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

user_namespaces.7: Minor tweaks to example program

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

setns.2: tfix

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

pid_namespaces.7: ffix

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

clone.2, namespaces.7, pid_namespaces.7, user_namespaces.7: wfix "file system" ==> "filesystem"

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

setns.2: A process can't join a new userns if it shares CLONE_FS attributes

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

unshare.2: tfix

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

unshare.2: wfix

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

unshare.2: CLONE_NEWUSER implies CLONE_FS

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

unshare.2: Remove obsolete reference to "Restrictions" text in user_namespaces(7)

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

user_namespaces.7: Remove discussion of flags that can't be used with CLONE_NEWUSER

That information is better put into individual pages.

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

clone.2: Improve discussion of flags that can't be specified with CLONE_NEWUSER

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

semop.2: Refer to clone(2) for semantics of CLONE_SYSVSEM and semadj lists

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

clone.2: Add more detail on the meaning of CLONE_SYVSEM

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

unshare.2: Clarify semantics of CLONE_SYSVSEM

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

unshare.2: CLONE_SYSVSEM does not require CAP_SYS_ADMIN

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

unshare.2: CLONE_NEWPID automatically implies CLONE_THREAD

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

unshare.2: CLONE_NEWUSER implies CLONE_THREAD

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

unshare.2: wfix

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

unshare.2: srcfix: update FIXMEs

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

clone.2: Note restrictions on CLONE_NEWUSER with other CLONE_* flags

Refer to user_namespaces(7) for restrictions on CLONE_NEWUSER
with other CLONE_* flags.

Also: document EINVAL error for CLONE_NEWUSER|CLONE_FS.

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

unshare.2: Note restrictions on CLONE_NEWUSER with other CLONE_* flags

Refer to user_namespaces(7) for restrictions on CLONE_NEWUSER
with other CLONE_* flags.

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

user_namespaces.7: Document restrictions on CLONE_NEWUSER with other CLONE_* flags

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

mq_overview.7: Refer to namespaces(7) for info on POSIX MQs and IPC namespaces

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

capabilities.7: Refer reader to user_namespaces(7) for a discussion of capabilities

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

capabilities.7: setns() needs CAP_SYS_ADMIN in the *target* namespace

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

pid_namespaces.7: Fix kernel version number for reboot() in pidns discussion

Should be 3.4, not 3.9, as per comments from Eric Biederman

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

pid_namespaces.7: Refer to reboot(2) for a discussion of reboot() inside a PID namespace

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

reboot.2: Tweak text on reboot in PID namesapces

Reviewed-by: Eric W. Biederman <ebiederm@xmission.com>
Signed-off-by: Michael Kerrisk <mtk.manpages@gmai>

reboot.2: Document effect of reboot() inside PID namespaces

Reported-by: Justin Cormack <justin@street-vision.com>
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

reboot.2: tfix

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

svipc.7: Refer to namespaces(7) for info on System V IPC and IPC namespaces

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

namespaces.7: Document /proc interfaces that are distinct in each IPC namespace

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

namespaces.7: Remove repetitious text under network namespaces

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

user_namespaces.7: srcfix

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

user_namespaces.7: Move discussion of availability of user namespaces to NOTES

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

user_namespaces.7: SEE ALSO: add newgidmap(1), newuidmap(1), subgid(5), subuid(5)

Pages in the "shadow" package

Reported-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

user_namespaces.7: execve(2) will drop capabilities unless the caller's UID maps to 0

Reported-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

user_namespaces.7: wfix

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

user_namespaces.7: Some subsystems don't support user namespaces in some kernel versions

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

user_namespaces.7: srcfix: Add FIXME

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

user_namespaces.7: Minor fixes in various places

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

user_namespaces.7: srcfix

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

user_namespaces.7: tfix

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

user_namespaces.7: Clarify some capabilities details

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

user_namespaces.7: Note treatment of "securebits" flags

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

user_namespaces.7: wfix

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

user_namespaces.7: Rewrote and reorganized various pieces

Mainly the pieces on capabilities, nested namespaces
and namespace membership.

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

user_namespaces.7: wfix

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

user_namespaces.7: SEE ALSO: remove unshare(1) (which is mentioned in namespaces(7))

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

user_namespaces.7: Clarify that the child of clone() gets all privileges in new userns

Nothing special happens for the children of unshare(2).

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

user_namespaces.7: Add reference to Documentation/namespaces/resource-control.txt

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

user_namespaces.7: Further reworking of text on nested namespaces and capabilities

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

user_namespaces.7: Relocate text on capabilities of initial process in userns

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

user_namespaces.7: Explain uid_map and gid_map in the initial user namespace

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

user_namespaces.7: Add more detail on unmapped UIDs and GIDs exposed to user space

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

user_namespaces.7: Reorganize various pieces of DESCRIPTION

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

user_namespaces.7: Remove duplicated text on EPERM + mapping required in parent userns

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>