userns: Allow PR_CAPBSET_DROP in a user namespace.
authorEric W. Biederman <ebiederm@xmission.com>
Tue, 2 Jul 2013 17:04:54 +0000 (10:04 -0700)
committerEric W. Biederman <ebiederm@xmission.com>
Sat, 31 Aug 2013 00:30:39 +0000 (17:30 -0700)
As the capabilites and capability bounding set are per user namespace
properties it is safe to allow changing them with just CAP_SETPCAP
permission in the user namespace.

Acked-by: Serge Hallyn <serge.hallyn@canonical.com>
Tested-by: Richard Weinberger <richard@nod.at>
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
security/commoncap.c

index c44b6fe6648e6945518db1a1be1c66b43131b875..9fccf71b2b62a854178e411dcbd76d3ba6b7c12e 100644 (file)
@@ -824,7 +824,7 @@ int cap_task_setnice(struct task_struct *p, int nice)
  */
 static long cap_prctl_drop(struct cred *new, unsigned long cap)
 {
-       if (!capable(CAP_SETPCAP))
+       if (!ns_capable(current_user_ns(), CAP_SETPCAP))
                return -EPERM;
        if (!cap_valid(cap))
                return -EINVAL;