From 9fd973e085f7759f710603422b2e11ad5f2e000d Mon Sep 17 00:00:00 2001 From: "Eric W. Biederman" Date: Wed, 30 Jan 2013 18:50:54 -0800 Subject: coda: Restrict coda messages to the initial pid namespace Remove the slight chance that pids in coda messages will be interpreted in the wrong pid namespace. - Explicitly send all pids in coda messages in the initial pid namespace. - Only allow mounts from processes in the initial pid namespace. - Only allow processes in the initial pid namespace to open the coda character device to communicate with coda. Cc: Jan Harkes Signed-off-by: "Eric W. Biederman" --- fs/coda/upcall.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'fs/coda/upcall.c') diff --git a/fs/coda/upcall.c b/fs/coda/upcall.c index 0c68fd31fbf2..5c6d2cd6ee86 100644 --- a/fs/coda/upcall.c +++ b/fs/coda/upcall.c @@ -50,8 +50,8 @@ static void *alloc_upcall(int opcode, int size) return ERR_PTR(-ENOMEM); inp->ih.opcode = opcode; - inp->ih.pid = current->pid; - inp->ih.pgid = task_pgrp_nr(current); + inp->ih.pid = task_pid_nr_ns(current, &init_pid_ns); + inp->ih.pgid = task_pgrp_nr_ns(current, &init_pid_ns); inp->ih.uid = current_fsuid(); return (void*)inp; -- cgit v1.2.3