diff options
| -rw-r--r-- | kernel/user_namespace.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c index aa312b0dc3ec..b99c862a2e3f 100644 --- a/kernel/user_namespace.c +++ b/kernel/user_namespace.c | |||
| @@ -812,7 +812,9 @@ static bool new_idmap_permitted(const struct file *file, | |||
| 812 | struct user_namespace *ns, int cap_setid, | 812 | struct user_namespace *ns, int cap_setid, |
| 813 | struct uid_gid_map *new_map) | 813 | struct uid_gid_map *new_map) |
| 814 | { | 814 | { |
| 815 | /* Allow mapping to your own filesystem ids */ | 815 | /* Don't allow mappings that would allow anything that wouldn't |
| 816 | * be allowed without the establishment of unprivileged mappings. | ||
| 817 | */ | ||
| 816 | if ((new_map->nr_extents == 1) && (new_map->extent[0].count == 1)) { | 818 | if ((new_map->nr_extents == 1) && (new_map->extent[0].count == 1)) { |
| 817 | u32 id = new_map->extent[0].lower_first; | 819 | u32 id = new_map->extent[0].lower_first; |
| 818 | if (cap_setid == CAP_SETUID) { | 820 | if (cap_setid == CAP_SETUID) { |