userns: Document what the invariant required for safe unprivileged mappings.

[platform/kernel/linux-stable.git] / kernel / user_namespace.c

diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c
index 9bea1d7..5979020 100644 (file)
--- a/kernel/user_namespace.c
+++ b/kernel/user_namespace.c
@@ -800,7 +800,9 @@ static bool new_idmap_permitted(const struct file *file,
                                struct user_namespace *ns, int cap_setid,
                                struct uid_gid_map *new_map)
 {
-       /* Allow mapping to your own filesystem ids */
+       /* Don't allow mappings that would allow anything that wouldn't
+        * be allowed without the establishment of unprivileged mappings.
+        */
        if ((new_map->nr_extents == 1) && (new_map->extent[0].count == 1)) {
                u32 id = new_map->extent[0].lower_first;
                if (cap_setid == CAP_SETUID) {