Access to timerslack_ns is controlled by a process having CAP_SYS_NICE in its effective capability set, but the current check looks in the root namespace instead of the process' user namespace. Since a process is allowed to do other activities controlled by CAP_SYS_NICE inside a namespace, it should also be able to adjust timerslack_ns.
Signed-off-by: Benjamin Gordon <[email protected]> Cc: John Stultz <[email protected]> Cc: "Eric W. Biederman" <[email protected]> Cc: Kees Cook <[email protected]> Cc: "Serge E. Hallyn" <[email protected]> Cc: Thomas Gleixner <[email protected]> Cc: Arjan van de Ven <[email protected]> Cc: Oren Laadan <[email protected]> Cc: Ruchi Kandoi <[email protected]> Cc: Rom Lemarchand <[email protected]> Cc: Todd Kjos <[email protected]> Cc: Colin Cross <[email protected]> Cc: Nick Kralevich <[email protected]> Cc: Dmitry Shmidt <[email protected]> Cc: Elliott Hughes <[email protected]> Cc: Android Kernel Team <[email protected]> Cc: Andrew Morton <[email protected]> --- Changes from v1: - Use the namespace of the target process instead of the file opener. Didn't carry over John Stultz' Acked-by since the changes aren't cosmetic. fs/proc/base.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/fs/proc/base.c b/fs/proc/base.c index c78d8da09b52c..bdc093ba81dd3 100644 --- a/fs/proc/base.c +++ b/fs/proc/base.c @@ -2385,10 +2385,13 @@ static ssize_t timerslack_ns_write(struct file *file, const char __user *buf, return -ESRCH; if (p != current) { - if (!capable(CAP_SYS_NICE)) { + rcu_read_lock(); + if (!ns_capable(__task_cred(p)->user_ns, CAP_SYS_NICE)) { + rcu_read_unlock(); count = -EPERM; goto out; } + rcu_read_unlock(); err = security_task_setscheduler(p); if (err) { @@ -2421,11 +2424,14 @@ static int timerslack_ns_show(struct seq_file *m, void *v) return -ESRCH; if (p != current) { - - if (!capable(CAP_SYS_NICE)) { + rcu_read_lock(); + if (!ns_capable(__task_cred(p)->user_ns, CAP_SYS_NICE)) { + rcu_read_unlock(); err = -EPERM; goto out; } + rcu_read_unlock(); + err = security_task_getscheduler(p); if (err) goto out; -- 2.19.1.568.g152ad8e336-goog
