diff options
| author | Michael Kerrisk <mtk.manpages@gmail.com> | 2013-01-14 09:54:00 +0100 |
|---|---|---|
| committer | Michael Kerrisk <mtk.manpages@gmail.com> | 2014-09-13 20:15:57 -0700 |
| commit | 37d12157fd420b46ac5b0502d475ceda38dbde10 (patch) | |
| tree | 16a964f015b1bd2c2cb740224dca6d93a5ceb00d /man7/namespaces.7 | |
| parent | 2a4cbd77a1ef430ae92c29bfb4efd350514c4d10 (diff) | |
| download | man-pages-37d12157fd420b46ac5b0502d475ceda38dbde10.tar.gz | |
namespaces.7: Note exception to permissions needed when writing to uid_map/gid_lmap
Quoting mail with Eric Biederman:
>>> So, by the way, I added this sentence to the page:
>>>
>>> In order to write to the /proc/[pid]/uid_map
>>> (/proc/[pid]/gid_map) file, a process must have the
>>> CAP_SETUID (CAP_SETGID) capability in the user namespace
>>> of the process pid.
>>>
>>> Is that correct?
>>
>> Yes.
>>
>>> But, there appear to be more rules than this governing whether a
>>> process can write to the file (i.e., various other -EPERM cases). What
>>> are the rules?
>>
>> In general you must also have CAP_SETUID (CAP_SETGID) in the parent user
>> namespace as well. The one exception to that is if you are mapping
>> your current uid and gid.
>
> Can you clarify what you mean by "mapping your own UID and GID" please
> (i.e., who is "you" in that sentence).
At the time of clone() or unshare() that creates a new user namespace,
the kuid and the kgid of the process does not change.
setuid and setgid fail before any mappings are set up.
Therefore the caller is allowed to map any single uid to the uid of the
caller in the parent user namespace. Likewise the caller is allowed to
map any single gid to the gid of the caller in the parent user
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>
Diffstat (limited to 'man7/namespaces.7')
| -rw-r--r-- | man7/namespaces.7 | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/man7/namespaces.7 b/man7/namespaces.7 index e476950e71..6ca493c997 100644 --- a/man7/namespaces.7 +++ b/man7/namespaces.7 @@ -608,6 +608,13 @@ The process must have the .BR CAP_SETUID .RB ( CAP_SETGID ) capability in the parent user namespace. +There is an exception to this requirement: +a process writing to +.I uid_map +.RI ( gid_map ) +is allowed to map any single UID (GID) to the file system UID (GID) of the +caller in the parent user namespace. + .IP * The process must be in either the user namespace of the process .I pid |