Re: [PATCH] isolation: keep CAP_SYS_PTRACE when required

On Fri, 23 Jun 2023 10:25:32 +0200
Paul Holzinger <pholzing(a)redhat.com> wrote:

...
  When pasta is started from an existing userns and
tries to join the
 netns from another process it fails to open /proc/$pid/ns/net due the
 missing CAP_SYS_PTRACE capability in the --netns-only case.
 
 A simple reproducer for this.
 First create a userns:
 $ unshare -r
 
 Then create a new netns inside it and try to join that netns with pasta.
 $ unshare -n sleep inf &
 $ pasta --config-net --netns /proc/$!/ns/net
 
 Signed-off-by: Paul Holzinger <pholzing(a)redhat.com> 
Applied.

-- 
Stefano