Messages in this thread | | | Date | Fri, 4 Dec 2015 13:02:14 -0600 | From | "Serge E. Hallyn" <> | Subject | Re: [PATCH 12/19] fs: Don't remove suid for CAP_FSETID in s_user_ns |
| |
Quoting Seth Forshee (seth.forshee@canonical.com): > Expand the check in should_remove_suid() to keep privileges for > CAP_FSETID in s_user_ns rather than init_user_ns. > > Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
Acked-by: Serge Hallyn <serge.hallyn@canonical.com>
> --- > fs/inode.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/fs/inode.c b/fs/inode.c > index 01c036fe1950..3e7c74da9304 100644 > --- a/fs/inode.c > +++ b/fs/inode.c > @@ -1684,7 +1684,8 @@ int should_remove_suid(struct dentry *dentry) > if (unlikely((mode & S_ISGID) && (mode & S_IXGRP))) > kill |= ATTR_KILL_SGID; > > - if (unlikely(kill && !capable(CAP_FSETID) && S_ISREG(mode))) > + if (unlikely(kill && !ns_capable(dentry->d_sb->s_user_ns, CAP_FSETID) && > + S_ISREG(mode))) > return kill; > > return 0; > -- > 1.9.1 > > -- > To unsubscribe from this list: send the line "unsubscribe linux-kernel" in > the body of a message to majordomo@vger.kernel.org > More majordomo info at http://vger.kernel.org/majordomo-info.html > Please read the FAQ at http://www.tux.org/lkml/
| |