On Thu, Feb 19, 2015 at 8:38 AM, Alexander Larsson <alexl redhat com> wrote:
On Tue, 2015-02-17 at 13:23 -0800, Andy Lutomirski wrote:- setuid / privileged helper. Why do you need a privileged helper? You should be able to do all of this using user namespaces. The Sandstorm code linked above does exactly this.I tried this a bit, but i ran into two snags i don't understand. First of all, as uid/gid 1000 i can put "1000 1000 1" in /proc/self/uid_map from the child. However, i cannot put "1000 1000 1" into gid_map, as i get EPERM. I don't understand this, is this not supposed to work?
You need newer manpages :-/ Try the attached variant.
Secondly, i'm failing to mount another instance of devpts. It fails with EINVAL.
Hmm. Off the top of my head, there's no good reason that devpts with the newinstance option couldn't be allowed in a userns. Eric, any thoughts here? The patch would be straightforward. --Andy
Attachment:
test-user.c
Description: Text Data