The patch titled Subject: prctl: use CAP_SYS_RESOURCE for PR_SET_MM option has been added to the -mm tree. Its filename is prctl-use-cap_sys_resource-for-pr_set_mm-option.patch Before you just go and hit "reply", please: a) Consider who else should be cc'ed b) Prefer to cc a suitable mailing list as well c) Ideally: find the original patch on the mailing list and do a reply-to-all to that, adding suitable additional cc's *** Remember to use Documentation/SubmitChecklist when testing your code *** The -mm tree is included into linux-next and is updated there every 3-4 working days ------------------------------------------------------ From: Cyrill Gorcunov <gorcunov@xxxxxxxxxx> Subject: prctl: use CAP_SYS_RESOURCE for PR_SET_MM option CAP_SYS_ADMIN is already overloaded left and right, so to have more fine-grained access control use CAP_SYS_RESOURCE here. The CAP_SYS_RESOUCE is chosen because this prctl option allows a current process to adjust some fields of memory map descriptor which rather represents what the process owns: pointers to code, data, stack segments, command line, auxiliary vector data and etc. Suggested-by: Michael Kerrisk <mtk.manpages@xxxxxxxxx> Acked-by: Kees Cook <keescook@xxxxxxxxxxxx> Acked-by: Michael Kerrisk <mtk.manpages@xxxxxxxxx> Cc: Pavel Emelyanov <xemul@xxxxxxxxxxxxx> Cc: Tejun Heo <tj@xxxxxxxxxx> Cc: Oleg Nesterov <oleg@xxxxxxxxxx> Cc: Paul Bolle <pebolle@xxxxxxxxxx> Cc: KOSAKI Motohiro <kosaki.motohiro@xxxxxxxxxxxxxx> Signed-off-by: Cyrill Gorcunov <gorcunov@xxxxxxxxxx> Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx> --- kernel/sys.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff -puN kernel/sys.c~prctl-use-cap_sys_resource-for-pr_set_mm-option kernel/sys.c --- a/kernel/sys.c~prctl-use-cap_sys_resource-for-pr_set_mm-option +++ a/kernel/sys.c @@ -1721,7 +1721,7 @@ static int prctl_set_mm(int opt, unsigne if (arg5 || (arg4 && opt != PR_SET_MM_AUXV)) return -EINVAL; - if (!capable(CAP_SYS_ADMIN)) + if (!capable(CAP_SYS_RESOURCE)) return -EPERM; if (addr >= TASK_SIZE) _ Subject: Subject: prctl: use CAP_SYS_RESOURCE for PR_SET_MM option Patches currently in -mm which might be from gorcunov@xxxxxxxxxx are linux-next.patch sysctl-make-kernelns_last_pid-control-being-checkpoint_restore-dependent.patch fs-proc-introduce-proc-pid-task-tid-children-entry-v9.patch syscalls-x86-add-__nr_kcmp-syscall-v8.patch syscalls-x86-add-__nr_kcmp-syscall-v8-fix.patch syscalls-x86-add-__nr_kcmp-syscall-v8-fix-2.patch c-r-procfs-add-arg_start-end-env_start-end-and-exit_code-members-to-proc-pid-stat.patch c-r-prctl-extend-pr_set_mm-to-set-up-more-mm_struct-entries-v2.patch prctl-use-cap_sys_resource-for-pr_set_mm-option.patch -- To unsubscribe from this list: send the line "unsubscribe mm-commits" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html