lkml.org 
[lkml]   [2013]   [Jul]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
Date
SubjectRe: [RFC PATCH 2/2] capabilities: allow nice if we are privileged
Serge Hallyn <serge.hallyn@ubuntu.com> writes:

> We allow task A to change B's nice level if it has a supserset of
> B's privileges, or of it has CAP_SYS_NICE. Also allow it if A has
> CAP_SYS_NICE with respect to B - meaning it is root in the same
> namespace, or it created B's namespace.

This patch looks good to me.

We already have this logic elsewhere in the kernel so I don't expect
this will make things worse.

Reviewed-by: "Eric W. Biederman" <ebiederm@xmission.com>

> Signed-off-by: Serge Hallyn <serge.hallyn@canonical.com>
> ---
> security/commoncap.c | 8 ++++----
> 1 file changed, 4 insertions(+), 4 deletions(-)
>
> diff --git a/security/commoncap.c b/security/commoncap.c
> index d78b003..ef98b56 100644
> --- a/security/commoncap.c
> +++ b/security/commoncap.c
> @@ -768,16 +768,16 @@ int cap_task_fix_setuid(struct cred *new, const struct cred *old, int flags)
> */
> static int cap_safe_nice(struct task_struct *p)
> {
> - int is_subset;
> + int is_subset, ret = 0;
>
> rcu_read_lock();
> is_subset = cap_issubset(__task_cred(p)->cap_permitted,
> current_cred()->cap_permitted);
> + if (!is_subset && !ns_capable(__task_cred(p)->user_ns, CAP_SYS_NICE))
> + ret = -EPERM;
> rcu_read_unlock();
>
> - if (!is_subset && !capable(CAP_SYS_NICE))
> - return -EPERM;
> - return 0;
> + return ret;
> }
>
> /**


\
 
 \ /
  Last update: 2013-07-24 10:41    [W:0.095 / U:26.248 seconds]
©2003-2017 Jasper Spaans. hosted at Digital OceanAdvertise on this site