On Wed, Jan 15, 2014 at 08:18:04PM -0000, Serge Hallyn wrote:
> The ns_capable line doesn't check the capabilities of tty->session,
> but rather current's capabilities targeted toward the user namespace
> which owns tty->session.
Okay, this was my fundamental misunderstanding. It makes sense now. This
plus the fact that mknod isn't allowed from a user ns alleviates my
concerns.
On Wed, Jan 15, 2014 at 08:18:04PM -0000, Serge Hallyn wrote:
> The ns_capable line doesn't check the capabilities of tty->session,
> but rather current's capabilities targeted toward the user namespace
> which owns tty->session.
Okay, this was my fundamental misunderstanding. It makes sense now. This
plus the fact that mknod isn't allowed from a user ns alleviates my
concerns.
I'll try this out.