Robert Swiecki 5beb5202d6 user: allow unprivileged user namespace creation when setgroups is denied ...

In unprivileged user namespaces, writing 'deny' to /proc/pid/setgroups is required by the kernel before gid_map can be written. This causes setgroups() to fail with EPERM, leaving inherited supplementary groups (mapped to overflowgid). Only fail closed when specific groups were explicitly requested (groups.size() > 0) or when setgroups denial was not expected.

2026-08-26 21:33:15 +02:00

9.9 KiB

Raw Permalink Blame History

View Raw