diff options
| author | Benno Schulenberg | 2016-03-17 10:39:13 +0100 |
|---|---|---|
| committer | Karel Zak | 2016-03-17 12:18:53 +0100 |
| commit | afaf31035d917f55d50ec3e10b6003755dd62c70 (patch) | |
| tree | 908f3313c52706668c94a644c9657cdd41bbc75d /sys-utils/unshare.1 | |
| parent | script: tweak spacing and wording, and restore filling in the man page (diff) | |
| download | kernel-qcow2-util-linux-afaf31035d917f55d50ec3e10b6003755dd62c70.tar.gz kernel-qcow2-util-linux-afaf31035d917f55d50ec3e10b6003755dd62c70.tar.xz kernel-qcow2-util-linux-afaf31035d917f55d50ec3e10b6003755dd62c70.zip | |
unshare: describe the setgroups restriction more explicitly
Signed-off-by: Benno Schulenberg <bensberg@justemail.net>
Diffstat (limited to 'sys-utils/unshare.1')
| -rw-r--r-- | sys-utils/unshare.1 | 25 |
1 files changed, 15 insertions, 10 deletions
diff --git a/sys-utils/unshare.1 b/sys-utils/unshare.1 index ba47c6733..cd873cb46 100644 --- a/sys-utils/unshare.1 +++ b/sys-utils/unshare.1 @@ -114,16 +114,21 @@ namespace (\fB\-\-mount\fP) is not requested. .BR "\-\-setgroups allow" | deny Allow or deny the .BR setgroups (2) -syscall in user namespaces. - -.BR setgroups (2) -is only callable with CAP_SETGID and CAP_SETGID in a user -namespace. Linux kernel (since 3.19) does not give you permission to call setgroups(2) -until after GID map has been set. The GID map is writable by root when -.BR setgroups (2) -is enabled and the GID map becomes writable by unprivileged processes when -.BR setgroups (2) -is permanently disabled. +syscall in a user namespace. +.sp +To be able to call +.BR setgroups (2), +the calling process must at least have CAP_SETGID. +But since Linux 3.19 a further restriction applies: +the kernel gives permission to call +.BR \%setgroups (2) +only after the GID map (\fB/proc/\fIpid\fB/gid_map\fR) has been set. +The GID map is writable by root when +.BR \%setgroups (2) +is enabled (i.e. \fBallow\fR, the default), and +the GID map becomes writable by unprivileged processes when +.BR \%setgroups (2) +is permanently disabled (with \fBdeny\fR). .TP .BR \-V , " \-\-version" Display version information and exit. |