diff options
| -rw-r--r-- | kernel/user_namespace.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c index 80a57afd8647..e382fcdc57d6 100644 --- a/kernel/user_namespace.c +++ b/kernel/user_namespace.c @@ -804,7 +804,9 @@ static bool new_idmap_permitted(const struct file *file, struct user_namespace *ns, int cap_setid, struct uid_gid_map *new_map) { - /* Allow mapping to your own filesystem ids */ + /* Don't allow mappings that would allow anything that wouldn't + * be allowed without the establishment of unprivileged mappings. + */ if ((new_map->nr_extents == 1) && (new_map->extent[0].count == 1)) { u32 id = new_map->extent[0].lower_first; if (cap_setid == CAP_SETUID) { |