unit.git/auto/isolation, branch 1.25.0-1 Universal Web Application Server Isolation: fixed build when features aren't detected. 2020-06-23T11:11:27+00:00 Tiago Natel de Moura t.nateldemoura@f5.com 2020-06-23T11:11:27+00:00 f8ba5d6c0093090e81819481e523af5fd27ab1e3 






Added "rootfs" feature.
2020-05-28T13:57:41+00:00

Tiago Natel de Moura
t.nateldemoura@f5.com

2020-05-28T13:57:41+00:00

e2b53e16c60ba1e3bbbe59172c184e97f889326b












Isolation: allowed the use of credentials with unpriv userns.
2019-12-06T16:52:50+00:00

Tiago Natel
t.nateldemoura@f5.com

2019-12-06T16:52:50+00:00

411daeaa532c47328ab901a7ba9ea5dcd876be06

The setuid/setgid syscalls requires root capabilities but if the kernel
supports unprivileged user namespace then the child process has the full
set of capabilities in the new namespace, then we can allow setting "user"
and "group" in such cases (this is a common security use case).

Tests were added to ensure user gets meaningful error messages for
uid/gid mapping misconfigurations.





The setuid/setgid syscalls requires root capabilities but if the kernel
supports unprivileged user namespace then the child process has the full
set of capabilities in the new namespace, then we can allow setting "user"
and "group" in such cases (this is a common security use case).

Tests were added to ensure user gets meaningful error messages for
uid/gid mapping misconfigurations.







Initial applications isolation support using Linux namespaces.
2019-09-19T12:25:23+00:00

Tiago de Bem Natel de Moura
t.nateldemoura@f5.com

2019-09-19T12:25:23+00:00

c554941b4f826d83d92d5ca8d7713bea4167896e