Re: [PATCH] isolation: keep CAP_SYS_PTRACE when required

On Fri, 23 Jun 2023 10:25:32 +0200 Paul Holzinger wrote:

When pasta is started from an existing userns and tries to join the netns from another process it fails to open /proc/$pid/ns/net due the missing CAP_SYS_PTRACE capability in the --netns-only case.

A simple reproducer for this. First create a userns: $ unshare -r

Then create a new netns inside it and try to join that netns with pasta. $ unshare -n sleep inf & $ pasta --config-net --netns /proc/$!/ns/net

Signed-off-by: Paul Holzinger

Applied. -- Stefano