Update Linux kernel release to v7.2.8-5 for base and BORE kernels

Signed-off-by: Krzysztof Wilczyński <kwilczynski@omarchy.org>
2026-10-07 11:14:42 +09:00
1 parent 64e7914900
commit 223f1d3438
@@ -0,0 +1,55 @@
+diff --git a/kernel/fork.c b/kernel/fork.c
+--- a/kernel/fork.c
+++ b/kernel/fork.c
+@@ -127,6 +127,12 @@
+ 
+ #include <kunit/visibility.h>
+ 
+#ifdef CONFIG_USER_NS
+static int unprivileged_userns_clone = 1;
+#else
+#define unprivileged_userns_clone 1
+#endif
+
+ /*
+  * Minimum number of threads to boot the kernel
+  */
+@@ -2092,6 +2098,11 @@ __latent_entropy struct task_struct *copy_process(
+ 			return ERR_PTR(-EPERM);
+ 	}
+ 
+	if ((clone_flags & CLONE_NEWUSER) && !unprivileged_userns_clone) {
+		if (!capable(CAP_SYS_ADMIN))
+			return ERR_PTR(-EPERM);
+	}
+
+ 	/*
+ 	 * Force any signals received before this point to be delivered
+ 	 * before the fork happens.  Collect up signals sent to multiple
+@@ -3165,6 +3176,10 @@ static int check_unshare_flags(unsigned long unshare_flags)
+ 		if (!current_is_single_threaded())
+ 			return -EINVAL;
+ 	}
+	if ((unshare_flags & CLONE_NEWUSER) && !unprivileged_userns_clone) {
+		if (!capable(CAP_SYS_ADMIN))
+			return -EPERM;
+	}
+ 
+ 	return 0;
+ }
+@@ -3400,6 +3415,15 @@ static const struct ctl_table fork_sysctl_table[] = {
+ 		.mode		= 0644,
+ 		.proc_handler	= sysctl_max_threads,
+ 	},
+#ifdef CONFIG_USER_NS
+	{
+		.procname	= "unprivileged_userns_clone",
+		.data		= &unprivileged_userns_clone,
+		.maxlen		= sizeof(int),
+		.mode		= 0644,
+		.proc_handler	= proc_dointvec,
+	},
+#endif
+ };
+ 
+ static int __init init_fork_sysctl(void)