userns: Allow setting gid_maps without privilege when setgroups is disabled
authorEric W. Biederman <ebiederm@xmission.com>
Sat, 6 Dec 2014 01:36:04 +0000 (19:36 -0600)
committerEric W. Biederman <ebiederm@xmission.com>
Fri, 12 Dec 2014 00:07:06 +0000 (18:07 -0600)
commit66d2f338ee4c449396b6f99f5e75cd18eb6df272
tree6ee765ac11630eb41207b1b4f4202c4d602fa459
parent9cc46516ddf497ea16e8d7cb986ae03a0f6b92f8
userns: Allow setting gid_maps without privilege when setgroups is disabled

Now that setgroups can be disabled and not reenabled, setting gid_map
without privielge can now be enabled when setgroups is disabled.

This restores most of the functionality that was lost when unprivileged
setting of gid_map was removed.  Applications that use this functionality
will need to check to see if they use setgroups or init_groups, and if they
don't they can be fixed by simply disabling setgroups before writing to
gid_map.

Cc: stable@vger.kernel.org
Reviewed-by: Andy Lutomirski <luto@amacapital.net>
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
kernel/user_namespace.c