lkml.org 
[lkml]   [2011]   [Feb]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [PATCH 6/9] user namespaces: convert all capable checks in kernel/sys.c
    On 02/17/2011 04:03 PM, Serge E. Hallyn wrote:
    > This allows setuid/setgid in containers. It also fixes some
    > corner cases where kernel logic foregoes capability checks when
    > uids are equivalent. The latter will need to be done throughout
    > the whole kernel.
    >
    > Changelog:
    > Jan 11: Use nsown_capable() as suggested by Bastian Blank.
    > Jan 11: Fix logic errors in uid checks pointed out by Bastian.
    > Feb 15: allow prlimit to current (was regression in previous version)
    >
    > Signed-off-by: Serge E. Hallyn<serge.hallyn@canonical.com>

    Acked-by: Daniel Lezcano <daniel.lezcano@free.fr>

    >
    > - if (!ns_capable(current->nsproxy->uts_ns->user_ns, CAP_SYS_ADMIN))
    > + if (!ns_capable(current->nsproxy->uts_ns->user_ns, CAP_SYS_ADMIN)) {
    > + printk(KERN_NOTICE "%s: did not have CAP_SYS_ADMIN\n", __func__);
    > return -EPERM;
    > + }
    > + printk(KERN_NOTICE "%s: did have CAP_SYS_ADMIN\n", __func__);

    A couple of printk left here.




    \
     
     \ /
      Last update: 2011-02-19 18:55    [W:5.678 / U:0.116 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site