ns vfs caps: first stab
New format for file capabilities, supporting per-container
capabilities. For now the capability must be written by
root on the host, but a new [gs]etfscap syscall would
support containers setting file capabilities for their
files, honored only in their own namespace.
File capabilities only work for containers which have a root
uid defined. We may want to at least allow -1 uids to work
in all namespaces.
We may want to allow uid ranges on capabilities.
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
4 files changed
