| commit | 0f19f1c20f842c13417b724e9beff40c7858e649 | [log] [tgz] |
|---|---|---|
| author | Kees Cook <keescook@chromium.org> | Fri Jan 22 14:06:58 2016 -0800 |
| committer | Kees Cook <keescook@chromium.org> | Sun Oct 02 21:57:04 2016 -0700 |
| tree | cda6a37fd3162e36cd08e72fb8056e5373b9ddb4 | |
| parent | 89071615e676b9c1bab573ffb3f9235a725715fe [diff] |
sysctl: allow CLONE_NEWUSER to be disabled There continues to be many CONFIG_USER_NS related security exposures. For admins running distro kernels with CONFIG_USER_NS, there is no way to disable CLONE_NEWUSER. As many systems do not need CLONE_NEWUSER, this provides a way for sysadmins to disable the feature. Signed-off-by: Kees Cook <keescook@chromium.org>