user namespace的限制

kernel/user_namespace.c

1. 不能reenter 同一个user namespace，避免通过这种方式获得权限
2. 不能修改一个线程的user namespace，一个进程内所有线程必须使用同一个namespace
3. 调用者和其他进程共享root directory （current->fs->users != 1）
4. target user namespace必须拥有CAP_SYS_ADMIN

static int userns_install(struct nsset *nsset, struct ns_common *ns)
{
    struct user_namespace *user_ns = to_user_ns(ns);
    struct cred *cred;
    /* Don't allow gaining capabilities by reentering
     * the same user namespace.
     */
    if (user_ns == current_user_ns())
        return -EINVAL;
    /* Tasks that share a thread group must share a user namespace */
    if (!thread_group_empty(current))
        return -EINVAL;
    if (current->fs->users != 1)
        return -EINVAL;
    if (!ns_capable(user_ns, CAP_SYS_ADMIN))
        return -EPERM;
    cred = nsset_cred(nsset);
    if (!cred)
        return -EINVAL;
    put_user_ns(cred->user_ns);
    set_cred_user_ns(cred, get_user_ns(user_ns));
    return 0;
}