diff options
| author | Kees Cook <keescook@chromium.org> | 2012-05-14 10:19:28 -0700 |
|---|---|---|
| committer | James Morris <james.l.morris@oracle.com> | 2012-05-15 10:27:57 +1000 |
| commit | 2cc8a71641b4460783ea3bd7a3476043fdf85397 (patch) | |
| tree | fe8a39bbedc403306c3a0c2f773a4499d6ae99ec /security/yama | |
| parent | 77b513dda90fd99bd1225410b25e745b74779c1c (diff) | |
| download | op-kernel-dev-2cc8a71641b4460783ea3bd7a3476043fdf85397.zip op-kernel-dev-2cc8a71641b4460783ea3bd7a3476043fdf85397.tar.gz | |
Yama: replace capable() with ns_capable()
When checking capabilities, the question we want to be asking is "does
current() have the capability in the child's namespace?"
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: James Morris <james.l.morris@oracle.com>
Diffstat (limited to 'security/yama')
| -rw-r--r-- | security/yama/yama_lsm.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/security/yama/yama_lsm.c b/security/yama/yama_lsm.c index c852f74..83554ee 100644 --- a/security/yama/yama_lsm.c +++ b/security/yama/yama_lsm.c @@ -264,11 +264,11 @@ static int yama_ptrace_access_check(struct task_struct *child, case YAMA_SCOPE_RELATIONAL: if (!task_is_descendant(current, child) && !ptracer_exception_found(current, child) && - !capable(CAP_SYS_PTRACE)) + !ns_capable(task_user_ns(child), CAP_SYS_PTRACE)) rc = -EPERM; break; case YAMA_SCOPE_CAPABILITY: - if (!capable(CAP_SYS_PTRACE)) + if (!ns_capable(task_user_ns(child), CAP_SYS_PTRACE)) rc = -EPERM; break; case YAMA_SCOPE_NO_ATTACH: |
