Messages in this thread | | | Date | Thu, 28 Feb 2008 15:35:07 -0600 | From | serge@hallyn ... | Subject | Re: Fw: [PATCH 1/1] file capabilities: simplify signal check |
| |
Quoting Eric W. Biederman (ebiederm@xmission.com): > serge@hallyn.com writes: > > > Quoting Eric W. Biederman (ebiederm@xmission.com): > >> Andrew Morton <akpm@linux-foundation.org> writes: > >> > >> > um, is that code namespace-clean? > >> > >> Choke, gag. > > > > Oh, sorry, I got lost in the set of patches in the message. To be > > clear, my little 4-patch uid-ns-signal patchset can simply be updated > > to make the cap_task_kill() uid check into if (task_user_equiv(current, p) > > > > But Eric if you simply drop cap_task_kill() (don't make it return 0, > > just drop the function and go back to not setting task_kill in the > > capability_security_ops) I'll ack that. Else I'll write the patch > > thursday. At this point the only thing that will be denied by > > cap_task_kill() but not by check_kill_permission() is funky euid cases. > > That's wrong. (cc'ing amorgan in the event I'm forgetting something > > useful the fn is doing) > > Go ahead. I'm fighting a cold and am fairly overloaded at the moment. > > Eric
Thanks - patch sent a little while ago. The description explains why I believe cap_task_kill() became worthless (not just 'it's inconvenient' :)
-serge
| |