Add --assert-userns-disabled option
We can't combine --disable-userns with entering an existing user namespace via --userns if the existing user namespace was created with --disable-userns, because its ability to create nested user namespaces has already been disabled. However, the next best thing is to verify that we are already in the desired state. Signed-off-by: Simon McVittie <smcv@collabora.com>
This commit is contained in:

committed by
Alexander Larsson

parent
b33c333bcb
commit
b5f672355b
@@ -126,10 +126,12 @@ else
|
||||
echo "ok - can pivot to new rootfs recursively"
|
||||
|
||||
$BWRAP --dev-bind / / -- true
|
||||
! $BWRAP --assert-userns-disabled --dev-bind / / -- true
|
||||
$BWRAP --unshare-user --disable-userns --dev-bind / / -- true
|
||||
! $BWRAP --unshare-user --disable-userns --dev-bind / / -- $BWRAP --dev-bind / / -- true
|
||||
$BWRAP --unshare-user --disable-userns --dev-bind / / -- sh -c "echo 2 > /proc/sys/user/max_user_namespaces || true; ! $BWRAP --dev-bind / / -- true"
|
||||
$BWRAP --unshare-user --disable-userns --dev-bind / / -- sh -c "echo 100 > /proc/sys/user/max_user_namespaces || true; ! $BWRAP --dev-bind / / -- true"
|
||||
$BWRAP --unshare-user --disable-userns --dev-bind / / -- sh -c "! $BWRAP --dev-bind / / --assert-userns-disabled -- true"
|
||||
echo "ok - can disable nested userns"
|
||||
fi
|
||||
|
||||
|
Reference in New Issue
Block a user