Messages in this thread | | | Date | Wed, 15 Jul 2020 17:08:11 +0200 | From | Christian Brauner <> | Subject | Re: [PATCH v5 2/6] pid: use checkpoint_restore_ns_capable() for set_tid |
| |
On Wed, Jul 15, 2020 at 04:49:50PM +0200, Adrian Reber wrote: > Use the newly introduced capability CAP_CHECKPOINT_RESTORE to allow > using clone3() with set_tid set. > > Signed-off-by: Adrian Reber <areber@redhat.com> > Signed-off-by: Nicolas Viennot <Nicolas.Viennot@twosigma.com> > ---
Looks good! Acked-by: Christian Brauner <christian.brauner@ubuntu.com>
> kernel/pid.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/kernel/pid.c b/kernel/pid.c > index de9d29c41d77..a9cbab0194d9 100644 > --- a/kernel/pid.c > +++ b/kernel/pid.c > @@ -199,7 +199,7 @@ struct pid *alloc_pid(struct pid_namespace *ns, pid_t *set_tid, > if (tid != 1 && !tmp->child_reaper) > goto out_free; > retval = -EPERM; > - if (!ns_capable(tmp->user_ns, CAP_SYS_ADMIN)) > + if (!checkpoint_restore_ns_capable(tmp->user_ns)) > goto out_free; > set_tid_size--; > } > -- > 2.26.2 >
| |