Techwizz/kernel-fxtec-pro1x
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

userns: Allow PR_CAPBSET_DROP in a user namespace.

Browse source 
As the capabilites and capability bounding set are per user namespace
properties it is safe to allow changing them with just CAP_SETPCAP
permission in the user namespace.

Acked-by: Serge Hallyn <serge.hallyn@canonical.com>
Tested-by: Richard Weinberger <richard@nod.at>
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
This commit is contained in:
Eric W. Biederman 2013-07-02 10:04:54 -07:00
parent dbef0c1c4c
commit 160da84dbb
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
security/commoncap.c
View file

@ -824,7 +824,7 @@ int cap_task_setnice(struct task_struct *p, int nice)
*/ */
static long cap_prctl_drop(struct cred *new, unsigned long cap) static long cap_prctl_drop(struct cred *new, unsigned long cap)
{ {
if (!capable(CAP_SETPCAP)) if (!ns_capable(current_user_ns(), CAP_SETPCAP))
return -EPERM; return -EPERM;
if (!cap_valid(cap)) if (!cap_valid(cap))
return -EINVAL; return -EINVAL;