tree 61ca8b8192d2109ac6f19c5f78bf6b14184ccc36
parent 3ad5d7e06a96d54a55acb5ab25938a06814605c8
author Serge Hallyn <serge.hallyn@ubuntu.com> 1448293434 -0600
committer Serge Hallyn <serge.hallyn@ubuntu.com> 1448673858 -0600

ns vfs caps: first stab

New format for file capabilities, supporting per-container
capabilities.  For now the capability must be written by
root on the host, but a new [gs]etfscap syscall would
support containers setting file capabilities for their
files, honored only in their own namespace.

File capabilities only work for containers which have a root
uid defined.  We may want to at least allow -1 uids to work
in all namespaces.

We may want to allow uid ranges on capabilities.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>