Serge Hallyn <serge.hallyn@xxxxxxxxxx> writes:
> We allow task A to change B's nice level if it has a supserset of
> B's privileges, or of it has CAP_SYS_NICE. Also allow it if A has
> CAP_SYS_NICE with respect to B - meaning it is root in the same
> namespace, or it created B's namespace.
This patch looks good to me.
We already have this logic elsewhere in the kernel so I don't expect
this will make things worse.
Reviewed-by: "Eric W. Biederman" <ebiederm@xxxxxxxxxxxx>
> Signed-off-by: Serge Hallyn <serge.hallyn@xxxxxxxxxxxxx>
> ---
> security/commoncap.c | 8 ++++----
> 1 file changed, 4 insertions(+), 4 deletions(-)
>
> diff --git a/security/commoncap.c b/security/commoncap.c
> index d78b003..ef98b56 100644
> --- a/security/commoncap.c
> +++ b/security/commoncap.c
> @@ -768,16 +768,16 @@ int cap_task_fix_setuid(struct cred *new, const struct cred *old, int flags)
> */
> static int cap_safe_nice(struct task_struct *p)
> {
> - int is_subset;
> + int is_subset, ret = 0;
>
> rcu_read_lock();
> is_subset = cap_issubset(__task_cred(p)->cap_permitted,
> current_cred()->cap_permitted);
> + if (!is_subset && !ns_capable(__task_cred(p)->user_ns, CAP_SYS_NICE))
> + ret = -EPERM;
> rcu_read_unlock();
>
> - if (!is_subset && !capable(CAP_SYS_NICE))
> - return -EPERM;
> - return 0;
> + return ret;
> }
>
> /**
_______________________________________________
Containers mailing list
Containers@xxxxxxxxxxxxxxxxxxxxxxxxxx
https://lists.linuxfoundation.org/mailman/listinfo/containers
