commit 7657d90497f98426af17f0ac633a9b335bb7a8fb
author Serge E. Hallyn <serue@us.ibm.com> Wed Dec 03 13:17:33 2008 -0600
committer James Morris <jmorris@namei.org> Mon Dec 08 09:16:27 2008 +1100
tree 6344dc4715a85383f6492a4102ae406c6b86d79d
parent c37bbb0fdcc01610fd55604eb6927210a1d20044

user namespaces: require cap_set{ug}id for CLONE_NEWUSER

While ideally CLONE_NEWUSER will eventually require no
privilege, the required permission checks are currently
not there.  As a result, CLONE_NEWUSER has the same effect
as a setuid(0)+setgroups(1,"0").  While we already require
CAP_SYS_ADMIN, requiring CAP_SETUID and CAP_SETGID seems
appropriate.

Signed-off-by: Serge E. Hallyn <serue@us.ibm.com>
Acked-by: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: James Morris <jmorris@namei.org>