[PATCH 4/5] capabilities: limit fscaps to where CAP_SETFCAP reaches

[sashiko-bot at kernel.org]

> Commit db2e718a4798 ("capabilities: require CAP_SETFCAP to map uid 0")
> keeps a root process without CAP_SETFCAP from creating a user namespace
> that maps uid 0, in which it could attach capabilities to a file that are
> then honoured outside.  It does not have to create one, though.  Any
> namespace will do that maps uid 0 and that it may enter, and it may enter
> all those that were created by uid 0:
> 
>   task A: uid 0, full caps          task B: uid 0, no CAP_SETFCAP
>   unshare(CLONE_NEWUSER)
>   write "0 0 1" to uid_map, gid_map
>                                     setns(A's user ns)
>                                       full capability set
>                                     setxattr(file, "security.capability")
>                                       rootid = kuid 0
>                                     (back in the initial namespace)
> [ ... ]
> own namespaces.  The rest gets -EPERM.
> 
> Fixes: 8db6c34f1dbc ("Introduce v3 namespaced file capabilities")
> Assisted-by: LLM
> Signed-off-by: Josef Bacik <josef at toxicpanda.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261006-b4-setfcap-userns-v1-0-f47e7ed66072@toxicpanda.com?part=4