evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Yama: replace capable() with ns_capable()

Browse source 
When checking capabilities, the question we want to be asking is "does
current() have the capability in the child's namespace?"

Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: James Morris <james.l.morris@oracle.com>
This commit is contained in:
Kees Cook 2012-05-14 10:19:28 -07:00 • committed by James Morris
parent 77b513dda9
commit 2cc8a71641
1 changed files with 2 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
security/yama/yama_lsm.c
View file

@ -264,11 +264,11 @@ static int yama_ptrace_access_check(struct task_struct *child,
case YAMA_SCOPE_RELATIONAL: case YAMA_SCOPE_RELATIONAL:
if (!task_is_descendant(current, child) && if (!task_is_descendant(current, child) &&
!ptracer_exception_found(current, child) && !ptracer_exception_found(current, child) &&
!capable(CAP_SYS_PTRACE)) !ns_capable(task_user_ns(child), CAP_SYS_PTRACE))
rc = -EPERM; rc = -EPERM;
break; break;
case YAMA_SCOPE_CAPABILITY: case YAMA_SCOPE_CAPABILITY:
if (!capable(CAP_SYS_PTRACE)) if (!ns_capable(task_user_ns(child), CAP_SYS_PTRACE))
rc = -EPERM; rc = -EPERM;
break; break;
case YAMA_SCOPE_NO_ATTACH: case YAMA_SCOPE_NO_ATTACH: