Messages in this thread Patch in this message | | | From | Stefan Berger <> | Subject | [RFC 16/20] ima: Use ns_capable() for namespace policy access | Date | Tue, 30 Nov 2021 11:06:50 -0500 |
| |
Replace capable() with ns_capable() for IMA namespace policy access with the CAP_SYS_ADMIN permission.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com> --- security/integrity/ima/ima_fs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/security/integrity/ima/ima_fs.c b/security/integrity/ima/ima_fs.c index 6c86f81c9998..fd2798f2d224 100644 --- a/security/integrity/ima/ima_fs.c +++ b/security/integrity/ima/ima_fs.c @@ -393,7 +393,7 @@ static int ima_open_policy(struct inode *inode, struct file *filp) #else if ((filp->f_flags & O_ACCMODE) != O_RDONLY) return -EACCES; - if (!capable(CAP_SYS_ADMIN)) + if (!ns_capable(ns->user_ns, CAP_SYS_ADMIN)) return -EPERM; return seq_open(filp, &ima_policy_seqops); #endif -- 2.31.1
| |