summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorEric W. Biederman <ebiederm@xmission.com>2013-07-02 10:04:54 -0700
committerChanho Park <chanho61.park@samsung.com>2014-11-18 11:47:01 +0900
commitac17dcba24894fde9657968ba10d28501c3a4ed3 (patch)
treeec41f543feeb38d34d081d2203783368d3df758e
parentcfeefb8237d985d9223679f012531842183df408 (diff)
downloadlinux-3.10-ac17dcba24894fde9657968ba10d28501c3a4ed3.tar.gz
linux-3.10-ac17dcba24894fde9657968ba10d28501c3a4ed3.tar.bz2
linux-3.10-ac17dcba24894fde9657968ba10d28501c3a4ed3.zip
userns: Allow PR_CAPBSET_DROP in a user namespace.
As the capabilites and capability bounding set are per user namespace properties it is safe to allow changing them with just CAP_SETPCAP permission in the user namespace. Change-Id: I65d5c6ef80d4196cc6b8cbc86a9661764c5b3ab1 Acked-by: Serge Hallyn <serge.hallyn@canonical.com> Tested-by: Richard Weinberger <richard@nod.at> Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com> Signed-off-by: Dariusz Michaluk <d.michaluk@samsung.com>
-rw-r--r--security/commoncap.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/security/commoncap.c b/security/commoncap.c
index c9219a66b7c..276f4d171e0 100644
--- a/security/commoncap.c
+++ b/security/commoncap.c
@@ -827,7 +827,7 @@ int cap_task_setnice(struct task_struct *p, int nice)
*/
static long cap_prctl_drop(struct cred *new, unsigned long cap)
{
- if (!capable(CAP_SETPCAP))
+ if (!ns_capable(current_user_ns(), CAP_SETPCAP))
return -EPERM;
if (!cap_valid(cap))
return -EINVAL;