runc/security/capabilities
Andrey Vagin 444cc2989a namespaces: allow to use pid namespace without mount namespace
The gocapability package uses /proc/PID/status to get a bounding set.
If a container uses pidns without mntns, it sees /proc from the host
namespace, but the process doesn't know its own pid in this namespace.

In this case it can use /proc/self/status, which is always the right one.

Signed-off-by: Andrew Vagin <avagin@openvz.org>
2015-02-04 01:01:43 +03:00
..
capabilities.go namespaces: allow to use pid namespace without mount namespace 2015-02-04 01:01:43 +03:00
types.go remove 2 duplicate caps 2014-07-11 00:31:35 +00:00
types_test.go Added DropCapabilities() and DropBoundingSet() API to libcontainer. 2014-06-23 18:36:38 +00:00