summary |
shortlog |
log |
commit | commitdiff |
tree
raw |
patch |
inline | side by side (from parent 1:
a6071d8)
Expand the check in should_remove_suid() to keep privileges for
CAP_FSETID in s_user_ns rather than init_user_ns.
--EWB Changed from ns_capable(sb->s_user_ns, ) to capable_wrt_inode_uidgid
Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
Acked-by: Serge Hallyn <serge.hallyn@canonical.com>
Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>
*/
int should_remove_suid(struct dentry *dentry)
{
*/
int should_remove_suid(struct dentry *dentry)
{
- umode_t mode = d_inode(dentry)->i_mode;
+ struct inode *inode = d_inode(dentry);
+ umode_t mode = inode->i_mode;
int kill = 0;
/* suid always must be killed */
int kill = 0;
/* suid always must be killed */
if (unlikely((mode & S_ISGID) && (mode & S_IXGRP)))
kill |= ATTR_KILL_SGID;
if (unlikely((mode & S_ISGID) && (mode & S_IXGRP)))
kill |= ATTR_KILL_SGID;
- if (unlikely(kill && !capable(CAP_FSETID) && S_ISREG(mode)))
+ if (unlikely(kill && !capable_wrt_inode_uidgid(inode, CAP_FSETID) &&
+ S_ISREG(mode)))