#include <linux/pid_namespace.h>
#include <linux/idr.h>
#include <linux/vmalloc.h> /* TODO: replace with more sophisticated array */
+#include <linux/capability.h>
#include <asm/atomic.h>
retval = ss->can_attach(ss, cgrp, tsk, false);
if (retval)
return retval;
+ } else if (!capable(CAP_SYS_ADMIN)) {
+ const struct cred *cred = current_cred(), *tcred;
+
+ /* No can_attach() - check perms generically */
+ tcred = __task_cred(tsk);
+ if (cred->euid != tcred->uid &&
+ cred->euid != tcred->suid) {
+ return -EACCES;
+ }
}
}
static int attach_task_by_pid(struct cgroup *cgrp, u64 pid)
{
struct task_struct *tsk;
- const struct cred *cred = current_cred(), *tcred;
int ret;
if (pid) {
rcu_read_unlock();
return -ESRCH;
}
-
- tcred = __task_cred(tsk);
- if (cred->euid &&
- cred->euid != tcred->uid &&
- cred->euid != tcred->suid) {
- rcu_read_unlock();
- return -EACCES;
- }
get_task_struct(tsk);
rcu_read_unlock();
} else {
/* make sure l doesn't vanish out from under us */
down_write(&l->mutex);
mutex_unlock(&cgrp->pidlist_mutex);
- l->use_count++;
return l;
}
}