Shanker Wang <shan...@tuna.tsinghua.edu.cn> writes: > This patch removes the check for CAP_NET_ADMIN in the initial namespace > when opening /dev/open. Instead, CAP_NET_ADMIN is checked in the user > namespace the net namespace was created so that /dev/ppp cat get opened > in a unprivileged container.
Seems dangerous. From a quick look at the PPP ioctl there is no limit how many PPP devices this can create. So a container having access to this would be able to fill all kernel memory. Probably needs more auditing and hardening first. In general there seems to be a lot of attack surface for root in PPP. -Andi -- a...@linux.intel.com -- Speaking for myself only
