userns: Allow unprivileged users to create new namespaces

If an unprivileged user has the appropriate capabilities in their
current user namespace allow the creation of new namespaces.

Acked-by: Serge Hallyn <serge.hallyn@canonical.com>
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>

diff --git a/kernel/nsproxy.c b/kernel/nsproxy.c
index 7f8b051fc19f7074491e07eaca24e1dabcda6957..a214e0e9035fd0fb76c1d7cbcc518bff8fb1aab8 100644 (file)
--- a/kernel/nsproxy.c
+++ b/kernel/nsproxy.c
@@ -122,6 +122,7 @@ out_ns:
 int copy_namespaces(unsigned long flags, struct task_struct *tsk)
 {
        struct nsproxy *old_ns = tsk->nsproxy;
+       struct user_namespace *user_ns = task_cred_xxx(tsk, user_ns);
        struct nsproxy *new_ns;
        int err = 0;
 
@@ -134,7 +135,7 @@ int copy_namespaces(unsigned long flags, struct task_struct *tsk)
                                CLONE_NEWPID | CLONE_NEWNET)))
                return 0;
 
-       if (!capable(CAP_SYS_ADMIN)) {
+       if (!ns_capable(user_ns, CAP_SYS_ADMIN)) {
                err = -EPERM;
                goto out;
        }
@@ -191,7 +192,7 @@ int unshare_nsproxy_namespaces(unsigned long unshare_flags,
                               CLONE_NEWNET | CLONE_NEWPID)))
                return 0;
 
-       if (!capable(CAP_SYS_ADMIN))
+       if (!nsown_capable(CAP_SYS_ADMIN))
                return -EPERM;
 
        *new_nsp = create_new_namespaces(unshare_flags, current,