From 8de90384363fe01f5258d36724dd3eae55918b5b Mon Sep 17 00:00:00 2001 From: Tycho Andersen Date: Thu, 9 May 2019 14:13:40 -0400 Subject: [PATCH] doc: add a little note about shared ns + LSMs We should add a little not about the race in the previous patch. Signed-off-by: Tycho Andersen --- doc/lxc.container.conf.sgml.in | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/doc/lxc.container.conf.sgml.in b/doc/lxc.container.conf.sgml.in index b03cf851f..782dede78 100644 --- a/doc/lxc.container.conf.sgml.in +++ b/doc/lxc.container.conf.sgml.in @@ -1722,6 +1722,12 @@ dev/null proc/kcore none bind,relative 0 0 process wants to inherit the other's network namespace it usually needs to inherit the user namespace as well. + + + Note that without careful additional configuration of an LSM, + sharing user+pid namespaces with a task may allow that task to + escalate privileges to that of the task calling liblxc. + -- 2.47.3