From 411daeaa532c47328ab901a7ba9ea5dcd876be06 Mon Sep 17 00:00:00 2001
From: Tiago Natel <t.nateldemoura@f5.com>
Date: Fri, 6 Dec 2019 16:52:50 +0000
Subject: Isolation: allowed the use of credentials with unpriv userns.

The setuid/setgid syscalls requires root capabilities but if the kernel
supports unprivileged user namespace then the child process has the full
set of capabilities in the new namespace, then we can allow setting "user"
and "group" in such cases (this is a common security use case).

Tests were added to ensure user gets meaningful error messages for
uid/gid mapping misconfigurations.
---
 auto/isolation | 5 +++++
 1 file changed, 5 insertions(+)

(limited to 'auto/isolation')

diff --git a/auto/isolation b/auto/isolation
index c26a4991..d231de12 100644
--- a/auto/isolation
+++ b/auto/isolation
@@ -5,6 +5,7 @@
 
 NXT_ISOLATION=NO
 NXT_HAVE_CLONE=NO
+NXT_HAVE_CLONE_NEWUSER=NO
 
 nsflags="USER NS PID NET UTS CGROUP"
 
@@ -42,6 +43,10 @@ if [ $nxt_found = yes ]; then
         . auto/feature
 
         if [ $nxt_found = yes ]; then
+            if [ $flag = "USER" ]; then
+                NXT_HAVE_CLONE_NEWUSER=YES
+            fi
+
             if [ "$NXT_ISOLATION" = "NO" ]; then
                 NXT_ISOLATION=$flag
             else
-- 
cgit