Quoting Seth Forshee (seth.forshee@xxxxxxxxxxxxx): > Expand the check in should_remove_suid() to keep privileges for > CAP_FSETID in s_user_ns rather than init_user_ns. > > Signed-off-by: Seth Forshee <seth.forshee@xxxxxxxxxxxxx> Acked-by: Serge Hallyn <serge.hallyn@xxxxxxxxxxxxx> > --- > fs/inode.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/fs/inode.c b/fs/inode.c > index 01c036fe1950..3e7c74da9304 100644 > --- a/fs/inode.c > +++ b/fs/inode.c > @@ -1684,7 +1684,8 @@ int should_remove_suid(struct dentry *dentry) > if (unlikely((mode & S_ISGID) && (mode & S_IXGRP))) > kill |= ATTR_KILL_SGID; > > - if (unlikely(kill && !capable(CAP_FSETID) && S_ISREG(mode))) > + if (unlikely(kill && !ns_capable(dentry->d_sb->s_user_ns, CAP_FSETID) && > + S_ISREG(mode))) > return kill; > > return 0; > -- > 1.9.1 > > -- > To unsubscribe from this list: send the line "unsubscribe linux-kernel" in > the body of a message to majordomo@xxxxxxxxxxxxxxx > More majordomo info at http://vger.kernel.org/majordomo-info.html > Please read the FAQ at http://www.tux.org/lkml/ -- dm-devel mailing list dm-devel@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/dm-devel
