From: ebiederm-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org (Eric W. Biederman)
To: Linux Containers
<containers-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org>
Cc: Richard Weinberger <richard-/L3Ra7n9ekc@public.gmane.org>,
linux-kernel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
Subject: [REVIEW][PATCH 2/5] userns: Allow PR_CAPBSET_DROP in a user namespace.
Date: Thu, 29 Aug 2013 16:54:00 -0700 [thread overview]
Message-ID: <87eh9cyrxj.fsf@xmission.com> (raw)
In-Reply-To: <87ob8gys0d.fsf-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org> (Eric W. Biederman's message of "Thu, 29 Aug 2013 16:52:18 -0700")
As the capabilites and capability bounding set are per user namespace
properties it is safe to allow changing them with just CAP_SETPCAP
permission in the user namespace.
Signed-off-by: "Eric W. Biederman" <ebiederm-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org>
Tested-by: Richard Weinberger <richard-/L3Ra7n9ekc@public.gmane.org>
---
security/commoncap.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/security/commoncap.c b/security/commoncap.c
index c44b6fe..9fccf71 100644
--- a/security/commoncap.c
+++ b/security/commoncap.c
@@ -824,7 +824,7 @@ int cap_task_setnice(struct task_struct *p, int nice)
*/
static long cap_prctl_drop(struct cred *new, unsigned long cap)
{
- if (!capable(CAP_SETPCAP))
+ if (!ns_capable(current_user_ns(), CAP_SETPCAP))
return -EPERM;
if (!cap_valid(cap))
return -EINVAL;
--
1.7.5.4
WARNING: multiple messages have this Message-ID (diff)
From: ebiederm@xmission.com (Eric W. Biederman)
To: Linux Containers <containers@lists.linux-foundation.org>
Cc: "Serge E. Hallyn" <serge@hallyn.com>,
<linux-kernel@vger.kernel.org>,
Richard Weinberger <richard@nod.at>
Subject: [REVIEW][PATCH 2/5] userns: Allow PR_CAPBSET_DROP in a user namespace.
Date: Thu, 29 Aug 2013 16:54:00 -0700 [thread overview]
Message-ID: <87eh9cyrxj.fsf@xmission.com> (raw)
In-Reply-To: <87ob8gys0d.fsf@xmission.com> (Eric W. Biederman's message of "Thu, 29 Aug 2013 16:52:18 -0700")
As the capabilites and capability bounding set are per user namespace
properties it is safe to allow changing them with just CAP_SETPCAP
permission in the user namespace.
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Tested-by: Richard Weinberger <richard@nod.at>
---
security/commoncap.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/security/commoncap.c b/security/commoncap.c
index c44b6fe..9fccf71 100644
--- a/security/commoncap.c
+++ b/security/commoncap.c
@@ -824,7 +824,7 @@ int cap_task_setnice(struct task_struct *p, int nice)
*/
static long cap_prctl_drop(struct cred *new, unsigned long cap)
{
- if (!capable(CAP_SETPCAP))
+ if (!ns_capable(current_user_ns(), CAP_SETPCAP))
return -EPERM;
if (!cap_valid(cap))
return -EINVAL;
--
1.7.5.4
next prev parent reply other threads:[~2013-08-29 23:54 UTC|newest]
Thread overview: 26+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-08-29 23:52 [REVIEW][PATCH 0/5] A couple of lingering namespace patches Eric W. Biederman
2013-08-29 23:52 ` Eric W. Biederman
[not found] ` <87ob8gys0d.fsf-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org>
2013-08-29 23:53 ` [REVIEW][PATCH 1/5] namespaces: Simplify copy_namespaces so it is clear what is going on Eric W. Biederman
2013-08-29 23:53 ` Eric W. Biederman
[not found] ` <87ioyoyryr.fsf-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org>
2013-08-30 16:10 ` Serge E. Hallyn
2013-08-30 16:10 ` Serge E. Hallyn
2013-08-29 23:54 ` Eric W. Biederman [this message]
2013-08-29 23:54 ` [REVIEW][PATCH 2/5] userns: Allow PR_CAPBSET_DROP in a user namespace Eric W. Biederman
[not found] ` <87eh9cyrxj.fsf-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org>
2013-08-30 1:15 ` Serge E. Hallyn
2013-08-30 1:15 ` Serge E. Hallyn
2013-08-29 23:55 ` [REVIEW][PATCH 3/5] pidns: Don't have unshare(CLONE_NEWPID) imply CLONE_THREAD Eric W. Biederman
2013-08-29 23:55 ` Eric W. Biederman
[not found] ` <87a9k0yrvu.fsf-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org>
2013-08-30 16:38 ` Serge E. Hallyn
2013-08-30 16:38 ` Serge E. Hallyn
[not found] ` <20130830163805.GB18857-7LNsyQBKDXoIagZqoN9o3w@public.gmane.org>
2013-08-30 23:49 ` Eric W. Biederman
2013-08-30 23:49 ` Eric W. Biederman
[not found] ` <87ppsuviwb.fsf-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org>
2013-08-31 5:31 ` Serge E. Hallyn
2013-08-31 5:31 ` Serge E. Hallyn
2013-09-08 17:00 ` Oleg Nesterov
2013-09-08 17:00 ` Oleg Nesterov
2013-08-29 23:55 ` [REVIEW][PATCH 4/5] capabilities: allow nice if we are privileged Eric W. Biederman
2013-08-29 23:55 ` Eric W. Biederman
2013-08-29 23:56 ` [REVIEW][PATCH 5/5] userns: Kill nsown_capable it makes the wrong thing easy Eric W. Biederman
2013-08-29 23:56 ` Eric W. Biederman
[not found] ` <871u5cyrst.fsf-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org>
2013-08-30 1:14 ` Serge E. Hallyn
2013-08-30 1:14 ` Serge E. Hallyn
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=87eh9cyrxj.fsf@xmission.com \
--to=ebiederm-as9lmozglivwk0htik3j/w@public.gmane.org \
--cc=containers-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org \
--cc=linux-kernel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org \
--cc=richard-/L3Ra7n9ekc@public.gmane.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.