LDP
/
man-pages
mirror of https://github.com/mkerrisk/man-pages
0
1
Fork 0
Code Releases Activity

setns.2: Various fixes for text on PID, user, and mount namespace support 

After comments from Eric Biederman

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>
This commit is contained in:
Michael Kerrisk 2012-12-31 23:41:31 +01:00
parent cd7e05aa16
commit 49af76fed3
1 changed files with 10 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
man2/setns.2
View File

@ -88,22 +88,25 @@ child processes will be created in.
Changing the PID namespace for child processes is only allowed if the
PID namespace specified by
.IR fd
is a child PID namespace of the PID namespace of the calling thread.
is a child PID namespace of the PID namespace of the caller.
A multi-threaded process may not change user namespace with
.BR setns ().
A process may not reassociate the thread with the current user
A process may not reassociate the thread with the caller's user
namespace.
The process reassociating itself with a user namespace must have
A process reassociating itself with a user namespace must have
.B CAP_SYS_ADMIN
.\" See kernel/user_namespace.c:userns_install() [3.8 source]
privileges in the target user namespace.
A process may not be reassociated with a new mount namespace if it is
multi-threaded or it does not possess both
multi-threaded.
.\" Above check is in fs/namespace.c:mntns_install() [3.8 source]
Changing the mount namespace requires that the caller possess both
.B CAP_SYS_CHROOT
and
.B CAP_SYS_ADMIN
rights over the target mount namespace.
.BR CAP_SYS_ADMIN
capabilities.
.SH RETURN VALUE
On success,
@ -122,7 +125,7 @@ is not a valid file descriptor.
.I fd
refers to a namespace whose type does not match that specified in
.IR nstype ,
or there is problem with reassociating the
or there is problem with reassociating
the thread with the specified namespace.
.TP
.B ENOMEM