[libvirt] [RFC PATCH 1/2] LXC: Drop capabilities only if we're not within a user namespace

[Richard Weinberger]

Am 25.06.2013 22:36, schrieb Daniel P. Berrange:
> On Thu, Jun 13, 2013 at 08:02:17PM +0200, Richard Weinberger wrote:
>> Dropping capabilities within a user namespace makes no sense
>> because any uid 0 process will regain all caps upon execve().
> 
> That is true, except for the fact that libvirt has removed the
> capabilities from the bounding set too. This prevents them being
> regained upon execve.

Are you sure that this applies also for user namespaces?

Thanks,
//richard