From 411daeaa532c47328ab901a7ba9ea5dcd876be06 Mon Sep 17 00:00:00 2001 From: Tiago Natel Date: Fri, 6 Dec 2019 16:52:50 +0000 Subject: Isolation: allowed the use of credentials with unpriv userns. The setuid/setgid syscalls requires root capabilities but if the kernel supports unprivileged user namespace then the child process has the full set of capabilities in the new namespace, then we can allow setting "user" and "group" in such cases (this is a common security use case). Tests were added to ensure user gets meaningful error messages for uid/gid mapping misconfigurations. --- src/test/nxt_tests.h | 1 + 1 file changed, 1 insertion(+) (limited to 'src/test/nxt_tests.h') diff --git a/src/test/nxt_tests.h b/src/test/nxt_tests.h index be4168cf..d531cc7d 100644 --- a/src/test/nxt_tests.h +++ b/src/test/nxt_tests.h @@ -64,6 +64,7 @@ nxt_int_t nxt_malloc_test(nxt_thread_t *thr); nxt_int_t nxt_utf8_test(nxt_thread_t *thr); nxt_int_t nxt_http_parse_test(nxt_thread_t *thr); nxt_int_t nxt_strverscmp_test(nxt_thread_t *thr); +nxt_int_t nxt_clone_creds_test(nxt_thread_t *thr); #endif /* _NXT_TESTS_H_INCLUDED_ */ -- cgit