| From | "Eric W. Biederman" <> | Date | Thu, 10 Feb 2022 20:13:23 -0600 | Subject | [PATCH 7/8] rlimit: For RLIMIT_NPROC test the child not the parent for capabilites |
| |
Ever since capabilities have become user namespace relative the capability checks to allow overrriing RLIMIT_NPROC in fork has been wrong. It is desirable to test the capabilities the new process will have not to test the capabilities of the existing process. In all cases except when creating a user namespace this does not matter, and even then not enforcing RLIMIT_NPROC on the root_user probably makes such a test moot.
Still the test is wrong in principle so fix it to the more stringent test.
Especially now that RLIMIT_NPROC enforcement has become per user namespace.
Fixes: 3486740a4f32 ("userns: security: make capabilities relative to the user namespace") Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com> --- kernel/fork.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/kernel/fork.c b/kernel/fork.c index 69333078259c..79661678a5bf 100644 --- a/kernel/fork.c +++ b/kernel/fork.c @@ -2030,7 +2030,8 @@ static __latent_entropy struct task_struct *copy_process( goto bad_fork_cleanup_count; if (is_ucounts_overlimit(task_ucounts(p), UCOUNT_RLIMIT_NPROC, rlimit(RLIMIT_NPROC))) { if ((task_ucounts(p) != &init_ucounts) && - !capable(CAP_SYS_RESOURCE) && !capable(CAP_SYS_ADMIN)) + !has_capability(p, CAP_SYS_RESOURCE) && + !has_capability(p, CAP_SYS_ADMIN)) goto bad_fork_cleanup_count; } current->flags &= ~PF_NPROC_CHECK; -- 2.29.2
|