From: Cyrill Gorcunov <gorcunov@gmail.com>
To: Greg KH <gregkh@linuxfoundation.org>
Cc: Tong Zhang <ztong@vt.edu>,
tglx@linutronix.de, akpm@linux-foundation.org,
linux@dominikbrodowski.net, ebiederm@xmission.com,
keescook@chromium.org, Dave.Martin@arm.com,
wolffhardt.schwabe@fau.de, yang.shi@linux.alibaba.com,
linux-kernel@vger.kernel.org, wenbo.s@samsung.com
Subject: Re: different capability from different namespace required for prctl_set_mm_exe_file
Date: Tue, 25 Sep 2018 21:34:27 +0300 [thread overview]
Message-ID: <20180925183427.GH15710@uranus> (raw)
In-Reply-To: <20180925173745.GA20508@kroah.com>
On Tue, Sep 25, 2018 at 07:37:45PM +0200, Greg KH wrote:
> On Tue, Sep 25, 2018 at 01:26:55PM -0400, Tong Zhang wrote:
> > Kernel Version: 4.18.5
> >
> > Problem Description:
> >
> > We discovered inconsistent check when using prctl_set_mm_exe_file(), which is used to setup exe file link.
> >
> > It is required to have capable(CAP_SYS_RESOURCE) in prctl_set_mm().
> > while ns_capable(CAP_SYS_ADMIN) in prctl_set_mm_map().
> >
> > There are two differences:
> > 1)requiring capability from: user namespace, init namespace.
> > 2)capability bit required is different
>
> Can you submit a patch showing what you think is the correct fix here?
It is done this way on purpose. The prctl_set_mm_map is a complex call
which carries a bunch of parameters and allowed if you're inside user-ns admin,
in turn prctl_set_mm allows to modify settings one by one. So no, it is not
an error but rather call specifics.
next prev parent reply other threads:[~2018-09-25 18:34 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-09-25 17:26 different capability from different namespace required for prctl_set_mm_exe_file Tong Zhang
2018-09-25 17:37 ` Greg KH
2018-09-25 18:34 ` Cyrill Gorcunov [this message]
2018-09-25 18:40 ` Greg KH
2018-09-25 18:54 ` Cyrill Gorcunov
2018-09-25 23:37 ` TongZhang
2018-09-26 6:59 ` Cyrill Gorcunov
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20180925183427.GH15710@uranus \
--to=gorcunov@gmail.com \
--cc=Dave.Martin@arm.com \
--cc=akpm@linux-foundation.org \
--cc=ebiederm@xmission.com \
--cc=gregkh@linuxfoundation.org \
--cc=keescook@chromium.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux@dominikbrodowski.net \
--cc=tglx@linutronix.de \
--cc=wenbo.s@samsung.com \
--cc=wolffhardt.schwabe@fau.de \
--cc=yang.shi@linux.alibaba.com \
--cc=ztong@vt.edu \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.