Don't use CLONE_NEWUSER for now

Until now, user namespaces have not done much, but (for that
reason) have been innocuous to glob in with other CLONE_
flags.  Upcoming userns development, however, will make tasks
cloned with CLONE_NEWUSER far more restricted.  In particular,
for some time they will be unable to access files with anything
other than the world access perms.

This patch assumes that noone really needs the user namespaces
to be enabled.  If that is wrong, then we can try a more
baroque patch where we create a file owned by a test userid with
700 perms and, if we can't access it after setuid'ing to that
userid, then return 0.  Otherwise, assume we are using an
older, 'harmless' user namespace implementation.

Comments appreciated.  Is it ok to do this?

Signed-off-by: Serge Hallyn <serge.hallyn@canonical.com>

diff --git a/src/lxc/lxc_container.c b/src/lxc/lxc_container.c
index 876bc62c1b5ad9405d0e183cb085acc6c679f53c..a735eb7881bed7a37babdc233db318b698c3496d 100644 (file)
--- a/src/lxc/lxc_container.c
+++ b/src/lxc/lxc_container.c
@@ -810,7 +810,14 @@ static int lxcContainerChild( void *data )
 
 static int userns_supported(void)
 {
+#if 1
+    /*
+     * put off using userns until uid mapping is implemented
+     */
+    return 0;
+#else
     return lxcContainerAvailable(LXC_CONTAINER_FEATURE_USER) == 0;
+#endif
 }
 
 /**