From: Eric W. Biederman <[email protected]> As the capabilites and capability bounding set are per user namespace properties it is safe to allow changing them with just CAP_SETPCAP permission in the user namespace.
Acked-by: Serge Hallyn <[email protected]> Tested-by: Richard Weinberger <[email protected]> Signed-off-by: "Eric W. Biederman" <[email protected]> Signed-off-by: Andrew Vagin <[email protected]> --- security/commoncap.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/security/commoncap.c b/security/commoncap.c index 3d7811d..59ff538 100644 --- a/security/commoncap.c +++ b/security/commoncap.c @@ -852,7 +852,7 @@ static int cap_prctl_drop(unsigned long cap) { struct cred *new; - if (!capable(CAP_SETPCAP)) + if (!ns_capable(current_user_ns(), CAP_SETPCAP)) return -EPERM; if (!cap_valid(cap)) return -EINVAL; -- 1.7.1 _______________________________________________ Devel mailing list [email protected] https://lists.openvz.org/mailman/listinfo/devel
