From: Oleg Nesterov <oleg@redhat.com>
To: Adrian Reber <areber@redhat.com>
Cc: Christian Brauner <christian@brauner.io>,
Eric Biederman <ebiederm@xmission.com>,
Pavel Emelianov <xemul@virtuozzo.com>,
Jann Horn <jannh@google.com>,
Dmitry Safonov <0x7f454c46@gmail.com>,
linux-kernel@vger.kernel.org, Andrei Vagin <avagin@gmail.com>,
Mike Rapoport <rppt@linux.ibm.com>,
Radostin Stoyanov <rstoyanov1@gmail.com>
Subject: Re: [PATCH v3 1/2] fork: extend clone3() to support CLONE_SET_TID
Date: Wed, 7 Aug 2019 18:08:56 +0200 [thread overview]
Message-ID: <20190807160856.GE24112@redhat.com> (raw)
In-Reply-To: <20190806191551.22192-1-areber@redhat.com>
On 08/06, Adrian Reber wrote:
>
> @@ -2573,6 +2575,14 @@ noinline static int copy_clone_args_from_user(struct kernel_clone_args *kargs,
> .tls = args.tls,
> };
>
> + if (size == sizeof(struct clone_args)) {
> + /* Only check permissions if set_tid is actually set. */
> + if (args.set_tid &&
> + !ns_capable(pid_ns->user_ns, CAP_SYS_ADMIN))
and I just noticed this uses pid_ns = task_active_pid_ns() ...
is it correct?
I feel I am totally confused, but should we use the same
p->nsproxy->pid_ns_for_children passed to alloc_pid?
Oleg.
next prev parent reply other threads:[~2019-08-07 16:09 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-08-06 19:15 [PATCH v3 1/2] fork: extend clone3() to support CLONE_SET_TID Adrian Reber
2019-08-06 19:15 ` [PATCH v3 2/2] selftests: add tests for clone3() Adrian Reber
2019-08-07 14:26 ` [PATCH v3 1/2] fork: extend clone3() to support CLONE_SET_TID Oleg Nesterov
2019-08-07 18:00 ` Christian Brauner
2019-08-07 15:48 ` Oleg Nesterov
2019-08-07 15:57 ` Dmitry Safonov
2019-08-07 16:21 ` Oleg Nesterov
2019-08-07 16:33 ` Dmitry Safonov
2019-08-07 16:47 ` Dmitry Safonov
2019-08-07 18:20 ` Christian Brauner
2019-08-07 16:08 ` Oleg Nesterov [this message]
2019-08-07 18:05 ` Christian Brauner
2019-08-07 17:55 ` Christian Brauner
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190807160856.GE24112@redhat.com \
--to=oleg@redhat.com \
--cc=0x7f454c46@gmail.com \
--cc=areber@redhat.com \
--cc=avagin@gmail.com \
--cc=christian@brauner.io \
--cc=ebiederm@xmission.com \
--cc=jannh@google.com \
--cc=linux-kernel@vger.kernel.org \
--cc=rppt@linux.ibm.com \
--cc=rstoyanov1@gmail.com \
--cc=xemul@virtuozzo.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.