Messages in this thread | | | Date | Mon, 10 Jan 2011 16:56:42 -0600 | From | Serge Hallyn <> | Subject | Re: [PATCH 6/7] user namespaces: convert all capable checks in kernel/sys.c |
| |
Quoting Bastian Blank (bastian@waldi.eu.org): > On Mon, Jan 10, 2011 at 09:14:07PM +0000, Serge E. Hallyn wrote: > > - if (pcred->uid != cred->euid && > > - pcred->euid != cred->euid && !capable(CAP_SYS_NICE)) { > > + if (pcred->user->user_ns != cred->user->user_ns && > > + pcred->uid != cred->euid && > > + pcred->euid != cred->euid && > > + !ns_capable(pcred->user->user_ns, CAP_SYS_NICE)) { > > I don't think this is correct. This would not error out if the both > userns are the same. Because the same patern (check uid if same userns, > otherwise only capability) shows up in several parts of the code, maybe > this should be factored out.
Yes, I'm really not sure what I was thinking here. Thanks!
> > @@ -496,7 +498,7 @@ SYSCALL_DEFINE2(setregid, gid_t, rgid, gid_t, egid) > > if (rgid != (gid_t) -1) { > > if (old->gid == rgid || > > old->egid == rgid || > > - capable(CAP_SETGID)) > > + ns_capable(current_user_ns(), CAP_SETGID)) > > Would it not possible to add another function (nsown_capable?) that > checks against the own userns?
Good idea, I'll add that one.
thanks, -serge
| |