Yama: replace capable() with ns_capable()
authorKees Cook <keescook@chromium.org>
Mon, 14 May 2012 17:19:28 +0000 (10:19 -0700)
committerJames Morris <james.l.morris@oracle.com>
Tue, 15 May 2012 00:27:57 +0000 (10:27 +1000)
When checking capabilities, the question we want to be asking is "does
current() have the capability in the child's namespace?"

Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: James Morris <james.l.morris@oracle.com>
security/yama/yama_lsm.c

index c852f7472ad0eee5c4459ce692f12ac7b77143c2..83554ee8a587fbf27bdc7095fa8a600b82aada57 100644 (file)
@@ -264,11 +264,11 @@ static int yama_ptrace_access_check(struct task_struct *child,
                case YAMA_SCOPE_RELATIONAL:
                        if (!task_is_descendant(current, child) &&
                            !ptracer_exception_found(current, child) &&
-                           !capable(CAP_SYS_PTRACE))
+                           !ns_capable(task_user_ns(child), CAP_SYS_PTRACE))
                                rc = -EPERM;
                        break;
                case YAMA_SCOPE_CAPABILITY:
-                       if (!capable(CAP_SYS_PTRACE))
+                       if (!ns_capable(task_user_ns(child), CAP_SYS_PTRACE))
                                rc = -EPERM;
                        break;
                case YAMA_SCOPE_NO_ATTACH: