lkml.org 
[lkml]   [2020]   [Jul]   [17]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [PATCH v5 0/6] capabilities: Introduce CAP_CHECKPOINT_RESTORE
    On Wed, Jul 15, 2020 at 04:49:48PM +0200, Adrian Reber wrote:
    > This is v5 of the 'Introduce CAP_CHECKPOINT_RESTORE' patchset. The
    > changes to v4 are:
    >
    > * split into more patches to have the introduction of
    > CAP_CHECKPOINT_RESTORE and the actual usage in different
    > patches
    > * reduce the /proc/self/exe patch to only be about
    > CAP_CHECKPOINT_RESTORE
    >
    > Adrian Reber (5):
    > capabilities: Introduce CAP_CHECKPOINT_RESTORE
    > pid: use checkpoint_restore_ns_capable() for set_tid
    > pid_namespace: use checkpoint_restore_ns_capable() for ns_last_pid
    > proc: allow access in init userns for map_files with CAP_CHECKPOINT_RESTORE
    > selftests: add clone3() CAP_CHECKPOINT_RESTORE test
    >
    > Nicolas Viennot (1):
    > prctl: Allow checkpoint/restore capable processes to change exe link

    (This is probably bad form, but) All

    Reviewed-by: Serge Hallyn <serge@hallyn.com>

    Assuming you changes patches 4 and 6 per Christian's suggestions,
    I'd like to re-review those then.

    >
    > fs/proc/base.c | 8 +-
    > include/linux/capability.h | 6 +
    > include/uapi/linux/capability.h | 9 +-
    > kernel/pid.c | 2 +-
    > kernel/pid_namespace.c | 2 +-
    > kernel/sys.c | 12 +-
    > security/selinux/include/classmap.h | 5 +-
    > tools/testing/selftests/clone3/Makefile | 4 +-
    > .../clone3/clone3_cap_checkpoint_restore.c | 203 ++++++++++++++++++
    > 9 files changed, 236 insertions(+), 15 deletions(-)
    > create mode 100644 tools/testing/selftests/clone3/clone3_cap_checkpoint_restore.c
    >
    >
    > base-commit: d31958b30ea3b7b6e522d6bf449427748ad45822
    > --
    > 2.26.2

    \
     
     \ /
      Last update: 2020-07-18 05:24    [W:4.086 / U:0.080 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site