Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2cc8a716 authored by Kees Cook's avatar Kees Cook Committed by James Morris
Browse files

Yama: replace capable() with ns_capable() 



When checking capabilities, the question we want to be asking is "does
current() have the capability in the child's namespace?"

Signed-off-by: default avatarKees Cook <keescook@chromium.org>
Signed-off-by: default avatarJames Morris <james.l.morris@oracle.com>
parent 77b513dd

security/yama/yama_lsm.c

+2 −2
Original line number Diff line number Diff line
@@ -264,11 +264,11 @@ static int yama_ptrace_access_check(struct task_struct *child, 
		case YAMA_SCOPE_RELATIONAL:

			if (!task_is_descendant(current, child) &&

			    !ptracer_exception_found(current, child) &&

			    !capable(CAP_SYS_PTRACE))

			    !ns_capable(task_user_ns(child), CAP_SYS_PTRACE))

				rc = -EPERM;

			break;

		case YAMA_SCOPE_CAPABILITY:

			if (!capable(CAP_SYS_PTRACE))

			if (!ns_capable(task_user_ns(child), CAP_SYS_PTRACE))

				rc = -EPERM;

			break;

		case YAMA_SCOPE_NO_ATTACH: