On Wed, Jul 15, 2020 at 04:49:50PM +0200, Adrian Reber wrote: > Use the newly introduced capability CAP_CHECKPOINT_RESTORE to allow > using clone3() with set_tid set. > > Signed-off-by: Adrian Reber <areber@xxxxxxxxxx> > Signed-off-by: Nicolas Viennot <Nicolas.Viennot@xxxxxxxxxxxx> > --- Looks good! Acked-by: Christian Brauner <christian.brauner@xxxxxxxxxx> > kernel/pid.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/kernel/pid.c b/kernel/pid.c > index de9d29c41d77..a9cbab0194d9 100644 > --- a/kernel/pid.c > +++ b/kernel/pid.c > @@ -199,7 +199,7 @@ struct pid *alloc_pid(struct pid_namespace *ns, pid_t *set_tid, > if (tid != 1 && !tmp->child_reaper) > goto out_free; > retval = -EPERM; > - if (!ns_capable(tmp->user_ns, CAP_SYS_ADMIN)) > + if (!checkpoint_restore_ns_capable(tmp->user_ns)) > goto out_free; > set_tid_size--; > } > -- > 2.26.2 >
