Messages in this thread Patch in this message | | | From | (Eric W. Biederman) | Date | Thu, 29 Aug 2013 16:54:00 -0700 | Subject | [REVIEW][PATCH 2/5] userns: Allow PR_CAPBSET_DROP in a user namespace. |
| |
As the capabilites and capability bounding set are per user namespace properties it is safe to allow changing them with just CAP_SETPCAP permission in the user namespace.
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com> Tested-by: Richard Weinberger <richard@nod.at> --- security/commoncap.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/security/commoncap.c b/security/commoncap.c index c44b6fe..9fccf71 100644 --- a/security/commoncap.c +++ b/security/commoncap.c @@ -824,7 +824,7 @@ int cap_task_setnice(struct task_struct *p, int nice) */ static long cap_prctl_drop(struct cred *new, unsigned long cap) { - if (!capable(CAP_SETPCAP)) + if (!ns_capable(current_user_ns(), CAP_SETPCAP)) return -EPERM; if (!cap_valid(cap)) return -EINVAL; -- 1.7.5.4
| |