lkml.org 
[lkml]   [2020]   [Jul]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [PATCH v5 2/6] pid: use checkpoint_restore_ns_capable() for set_tid
    On Wed, Jul 15, 2020 at 04:49:50PM +0200, Adrian Reber wrote:
    > Use the newly introduced capability CAP_CHECKPOINT_RESTORE to allow
    > using clone3() with set_tid set.
    >
    > Signed-off-by: Adrian Reber <areber@redhat.com>
    > Signed-off-by: Nicolas Viennot <Nicolas.Viennot@twosigma.com>
    > ---

    Looks good!
    Acked-by: Christian Brauner <christian.brauner@ubuntu.com>

    > kernel/pid.c | 2 +-
    > 1 file changed, 1 insertion(+), 1 deletion(-)
    >
    > diff --git a/kernel/pid.c b/kernel/pid.c
    > index de9d29c41d77..a9cbab0194d9 100644
    > --- a/kernel/pid.c
    > +++ b/kernel/pid.c
    > @@ -199,7 +199,7 @@ struct pid *alloc_pid(struct pid_namespace *ns, pid_t *set_tid,
    > if (tid != 1 && !tmp->child_reaper)
    > goto out_free;
    > retval = -EPERM;
    > - if (!ns_capable(tmp->user_ns, CAP_SYS_ADMIN))
    > + if (!checkpoint_restore_ns_capable(tmp->user_ns))
    > goto out_free;
    > set_tid_size--;
    > }
    > --
    > 2.26.2
    >

    \
     
     \ /
      Last update: 2020-07-15 17:09    [W:3.712 / U:0.164 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site