{"action":"created","issue":{"url":"https://api.github.com/repos/opencontainers/runc/issues/288","labels_url":"https://api.github.com/repos/opencontainers/runc/issues/288/labels{/name}","comments_url":"https://api.github.com/repos/opencontainers/runc/issues/288/comments","events_url":"https://api.github.com/repos/opencontainers/runc/issues/288/events","html_url":"https://github.com/opencontainers/runc/pull/288","id":107767215,"number":288,"title":"Enter existing user namespace if present","user":{"login":"gitido","id":1302219,"avatar_url":"https://avatars.githubusercontent.com/u/1302219?v=3","gravatar_id":"","url":"https://api.github.com/users/gitido","html_url":"https://github.com/gitido","followers_url":"https://api.github.com/users/gitido/followers","following_url":"https://api.github.com/users/gitido/following{/other_user}","gists_url":"https://api.github.com/users/gitido/gists{/gist_id}","starred_url":"https://api.github.com/users/gitido/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/gitido/subscriptions","organizations_url":"https://api.github.com/users/gitido/orgs","repos_url":"https://api.github.com/users/gitido/repos","events_url":"https://api.github.com/users/gitido/events{/privacy}","received_events_url":"https://api.github.com/users/gitido/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/opencontainers/runc/labels/status/0-triage","name":"status/0-triage","color":"ededed"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-09-22T17:59:04Z","updated_at":"2015-09-22T23:00:47Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/opencontainers/runc/pulls/288","html_url":"https://github.com/opencontainers/runc/pull/288","diff_url":"https://github.com/opencontainers/runc/pull/288.diff","patch_url":"https://github.com/opencontainers/runc/pull/288.patch"},"body":"When executing an additional process in a container, all namespaces are\r\nentered but the user namespace. As a result, the process may be\r\nexecuted as the host's root user. This has both functionality and\r\nsecurity implications.\r\n\r\nFix this by adding the missing user namespace to the array of\r\nnamespaces. Since joining a user namespace in which the caller is\r\nalready a member yields an error, skip namespaces we're already in.\r\n\r\nLast, remove a needless and buggy AT_SYMLINK_NOFOLLOW in the code.\r\n\r\nSigned-off-by: Ido Yariv <ido@wizery.com>"},"comment":{"url":"https://api.github.com/repos/opencontainers/runc/issues/comments/142444816","html_url":"https://github.com/opencontainers/runc/pull/288#issuecomment-142444816","issue_url":"https://api.github.com/repos/opencontainers/runc/issues/288","id":142444816,"user":{"login":"crosbymichael","id":749551,"avatar_url":"https://avatars.githubusercontent.com/u/749551?v=3","gravatar_id":"","url":"https://api.github.com/users/crosbymichael","html_url":"https://github.com/crosbymichael","followers_url":"https://api.github.com/users/crosbymichael/followers","following_url":"https://api.github.com/users/crosbymichael/following{/other_user}","gists_url":"https://api.github.com/users/crosbymichael/gists{/gist_id}","starred_url":"https://api.github.com/users/crosbymichael/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/crosbymichael/subscriptions","organizations_url":"https://api.github.com/users/crosbymichael/orgs","repos_url":"https://api.github.com/users/crosbymichael/repos","events_url":"https://api.github.com/users/crosbymichael/events{/privacy}","received_events_url":"https://api.github.com/users/crosbymichael/received_events","type":"User","site_admin":false},"created_at":"2015-09-22T23:00:47Z","updated_at":"2015-09-22T23:00:47Z","body":"LGTM"}}