diff options
| author | Eric W. Biederman <ebiederm@xmission.com> | 2013-07-02 10:04:54 -0700 |
|---|---|---|
| committer | Marek Szyprowski <m.szyprowski@samsung.com> | 2014-05-15 07:27:18 +0200 |
| commit | b92b2a4a296a6d3b453ea474b1d64baee3a50fb8 (patch) | |
| tree | 2dd74125cc0af3dbe1dcab4c97eaa0ac6182192c /security/commoncap.c | |
| parent | 3e52fdb1fdb6025504e087e128d4f5351b069fd6 (diff) | |
| download | linux-3.10-b92b2a4a296a6d3b453ea474b1d64baee3a50fb8.tar.gz linux-3.10-b92b2a4a296a6d3b453ea474b1d64baee3a50fb8.tar.bz2 linux-3.10-b92b2a4a296a6d3b453ea474b1d64baee3a50fb8.zip | |
userns: Allow PR_CAPBSET_DROP in a user namespace.
As the capabilites and capability bounding set are per user namespace
properties it is safe to allow changing them with just CAP_SETPCAP
permission in the user namespace.
Change-Id: I65d5c6ef80d4196cc6b8cbc86a9661764c5b3ab1
Acked-by: Serge Hallyn <serge.hallyn@canonical.com>
Tested-by: Richard Weinberger <richard@nod.at>
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: Dariusz Michaluk <d.michaluk@samsung.com>
Diffstat (limited to 'security/commoncap.c')
| -rw-r--r-- | security/commoncap.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/security/commoncap.c b/security/commoncap.c index c44b6fe6648..9fccf71b2b6 100644 --- a/security/commoncap.c +++ b/security/commoncap.c @@ -824,7 +824,7 @@ int cap_task_setnice(struct task_struct *p, int nice) */ static long cap_prctl_drop(struct cred *new, unsigned long cap) { - if (!capable(CAP_SETPCAP)) + if (!ns_capable(current_user_ns(), CAP_SETPCAP)) return -EPERM; if (!cap_valid(cap)) return -EINVAL; |