text: Am 06.06.2013 10:13, schrieb Daniel P. Berrange:
  On Thu, Jun 06, 2013 at 10:07:26AM +0200, Richard Weinberger wrote:Am:The hope is that this can be relaxed - it ought to be sufficient to just restrict access to the /proc/$PID/ns/ files to enforce permissions, or require CAP_SYS_ADMIN when opening the files only. I can't see any compelling reason why you should require CAP_SYS_ADMIN on setns() itself once you have the FDs open.Do you have user namespaces enabled by chance ?
  Yeah, but only within the kernel. Maybe this is why the setns() is failing for me.
  What is the plan to make lxc-enter-namespace work? Privilege separation is nice but as of now the kernel interface (setns()) seems not to allow this. Are you forcing the kernel guys to change the interface?It has long worked fine on Fedora, though we do not have user namespaces enabled since parts of the kernel are yet to be ported to that (XFS in particular). My best guess is that user namespaces may have caused a regression in this ability to call setns() from a separate process.
  Sounds sane. /me looks. :-) Thanks, //richard