Messages in this thread Patch in this message | | | Subject | [RFC][PATCH 10/20] capabilities: Update the capabilities code to handle pspaces. | From | (Eric W. Biederman) | Date | Mon, 06 Feb 2006 12:49:20 -0700 |
| |
Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>
---
kernel/capability.c | 56 +++++++++++++++++++++++++++++++-------------------- 1 files changed, 34 insertions(+), 22 deletions(-)
d84edcf08e16ef0af7170b494b371493d1829ee7 diff --git a/kernel/capability.c b/kernel/capability.c index bfa3c92..80a618b 100644 --- a/kernel/capability.c +++ b/kernel/capability.c @@ -12,6 +12,7 @@ #include <linux/module.h> #include <linux/security.h> #include <linux/syscalls.h> +#include <linux/pspace.h> #include <asm/uaccess.h> unsigned securebits = SECUREBITS_DEFAULT; /* systemwide security settings */ @@ -68,7 +69,7 @@ asmlinkage long sys_capget(cap_user_head read_lock(&tasklist_lock); if (pid && pid != current->pid) { - target = find_task_by_pid(pid); + target = find_task_by_pid(current->pspace, pid); if (!target) { ret = -ESRCH; goto out; @@ -96,11 +97,12 @@ static inline int cap_set_pg(int pgrp, k kernel_cap_t *inheritable, kernel_cap_t *permitted) { + struct pspace *pspace = current->pspace; task_t *g, *target; int ret = -EPERM; int found = 0; - do_each_task_pid(pgrp, PIDTYPE_PGID, g) { + do_each_task_pid(pspace, pgrp, PIDTYPE_PGID, g) { target = g; while_each_thread(g, target) { if (!security_capset_check(target, effective, @@ -113,7 +115,7 @@ static inline int cap_set_pg(int pgrp, k } found = 1; } - } while_each_task_pid(pgrp, PIDTYPE_PGID, g); + } while_each_task_pid(pspace, pgrp, PIDTYPE_PGID, g); if (!found) ret = 0; @@ -121,20 +123,26 @@ static inline int cap_set_pg(int pgrp, k } /* - * cap_set_all - set capabilities for all processes other than init - * and self. We call this holding task_capability_lock and tasklist_lock. - */ -static inline int cap_set_all(kernel_cap_t *effective, - kernel_cap_t *inheritable, - kernel_cap_t *permitted) + * cap_set_pspace - set capabilities for all processes in pspace + * other than init and self. We call this holding + * task_capability_lock and tasklist_lock. + */ +static inline int cap_set_pspace(struct pspace *pspace, + kernel_cap_t *effective, + kernel_cap_t *inheritable, + kernel_cap_t *permitted) { task_t *g, *target; int ret = -EPERM; int found = 0; do_each_thread(g, target) { - if (target == current || target->pid == 1) - continue; + if (target == current) + continue; + if (current_pspace_leader(target)) + continue; + if (!in_pspace(pspace, target)) + continue; found = 1; if (security_capset_check(target, effective, inheritable, permitted)) @@ -200,7 +208,7 @@ asmlinkage long sys_capset(cap_user_head read_lock(&tasklist_lock); if (pid > 0 && pid != current->pid) { - target = find_task_by_pid(pid); + target = find_task_by_pid(current->pspace, pid); if (!target) { ret = -ESRCH; goto out; @@ -212,20 +220,24 @@ asmlinkage long sys_capset(cap_user_head /* having verified that the proposed changes are legal, we now put them into effect. */ - if (pid < 0) { - if (pid == -1) /* all procs other than current and init */ - ret = cap_set_all(&effective, &inheritable, &permitted); + if (pid < 0) { + struct task_struct *p; - else /* all procs in process group */ - ret = cap_set_pg(-pid, &effective, &inheritable, + p = find_task_by_pid(current->pspace, -pid); + if (p && pspace_leader(p)) + /* all procs other than current and init */ + ret = cap_set_pspace(p->pspace, &effective, + &inheritable, &permitted); + else /* all procs in process group */ + ret = cap_set_pg(-pid, &effective, &inheritable, &permitted); - } else { - ret = security_capset_check(target, &effective, &inheritable, + } else { + ret = security_capset_check(target, &effective, &inheritable, &permitted); - if (!ret) - security_capset_set(target, &effective, &inheritable, + if (!ret) + security_capset_set(target, &effective, &inheritable, &permitted); - } + } out: read_unlock(&tasklist_lock); -- 1.1.5.g3480 - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |