From 28209ca05e132665f035b14342c6261b7f97e4b8 Mon Sep 17 00:00:00 2001 From: "Serge E. Hallyn" Date: Tue, 8 Feb 2011 20:58:24 -0600 Subject: [PATCH] Don't use CLONE_NEWUSER for now Until now, user namespaces have not done much, but (for that reason) have been innocuous to glob in with other CLONE_ flags. Upcoming userns development, however, will make tasks cloned with CLONE_NEWUSER far more restricted. In particular, for some time they will be unable to access files with anything other than the world access perms. This patch assumes that noone really needs the user namespaces to be enabled. If that is wrong, then we can try a more baroque patch where we create a file owned by a test userid with 700 perms and, if we can't access it after setuid'ing to that userid, then return 0. Otherwise, assume we are using an older, 'harmless' user namespace implementation. Comments appreciated. Is it ok to do this? Signed-off-by: Serge Hallyn --- src/lxc/lxc_container.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/src/lxc/lxc_container.c b/src/lxc/lxc_container.c index 876bc62c1b..a735eb7881 100644 --- a/src/lxc/lxc_container.c +++ b/src/lxc/lxc_container.c @@ -810,7 +810,14 @@ static int lxcContainerChild( void *data ) static int userns_supported(void) { +#if 1 + /* + * put off using userns until uid mapping is implemented + */ + return 0; +#else return lxcContainerAvailable(LXC_CONTAINER_FEATURE_USER) == 0; +#endif } /** -- 2.47.2