userns: Convert ptrace, kill, set_priority permission checks to work with kuids and...

Update the permission checks to use the new uid_eq and gid_eq helpers
and remove the now unnecessary user_ns equality comparison.

Acked-by: Serge Hallyn <serge.hallyn@canonical.com>
Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>

diff --git a/kernel/ptrace.c b/kernel/ptrace.c
index 24e0a5a94824b56396e9b515941b583a9725d350..a232bb59d93fa220e3720ce3d068b44d96ca24f3 100644 (file)
--- a/kernel/ptrace.c
+++ b/kernel/ptrace.c
@@ -198,13 +198,12 @@ int __ptrace_may_access(struct task_struct *task, unsigned int mode)
                return 0;
        rcu_read_lock();
        tcred = __task_cred(task);
-       if (cred->user_ns == tcred->user_ns &&
-           (cred->uid == tcred->euid &&
-            cred->uid == tcred->suid &&
-            cred->uid == tcred->uid  &&
-            cred->gid == tcred->egid &&
-            cred->gid == tcred->sgid &&
-            cred->gid == tcred->gid))
+       if (uid_eq(cred->uid, tcred->euid) &&
+           uid_eq(cred->uid, tcred->suid) &&
+           uid_eq(cred->uid, tcred->uid)  &&
+           gid_eq(cred->gid, tcred->egid) &&
+           gid_eq(cred->gid, tcred->sgid) &&
+           gid_eq(cred->gid, tcred->gid))
                goto ok;
        if (ptrace_has_cap(tcred->user_ns, mode))
                goto ok;

diff --git a/kernel/signal.c b/kernel/signal.c
index d6303277a6408dfe6944055c2ecf10459aa27e3f..aef629c65c87df202a10c619b53495639bda94ee 100644 (file)
--- a/kernel/signal.c
+++ b/kernel/signal.c
@@ -767,11 +767,10 @@ static int kill_ok_by_cred(struct task_struct *t)
        const struct cred *cred = current_cred();
        const struct cred *tcred = __task_cred(t);
 
-       if (cred->user_ns == tcred->user_ns &&
-           (cred->euid == tcred->suid ||
-            cred->euid == tcred->uid ||
-            cred->uid  == tcred->suid ||
-            cred->uid  == tcred->uid))
+       if (uid_eq(cred->euid, tcred->suid) ||
+           uid_eq(cred->euid, tcred->uid)  ||
+           uid_eq(cred->uid,  tcred->suid) ||
+           uid_eq(cred->uid,  tcred->uid))
                return 1;
 
        if (ns_capable(tcred->user_ns, CAP_KILL))
@@ -1389,10 +1388,8 @@ static int kill_as_cred_perm(const struct cred *cred,
                             struct task_struct *target)
 {
        const struct cred *pcred = __task_cred(target);
-       if (cred->user_ns != pcred->user_ns)
-               return 0;
-       if (cred->euid != pcred->suid && cred->euid != pcred->uid &&
-           cred->uid  != pcred->suid && cred->uid  != pcred->uid)
+       if (!uid_eq(cred->euid, pcred->suid) && !uid_eq(cred->euid, pcred->uid) &&
+           !uid_eq(cred->uid,  pcred->suid) && !uid_eq(cred->uid,  pcred->uid))
                return 0;
        return 1;
 }

diff --git a/kernel/sys.c b/kernel/sys.c
index aff09f208eb3b26f5676adcf4e0450fd821ddb00..f484077b6b148190816cbc9b8f6ccb19096b5262 100644 (file)
--- a/kernel/sys.c
+++ b/kernel/sys.c
@@ -131,9 +131,8 @@ static bool set_one_prio_perm(struct task_struct *p)
 {
        const struct cred *cred = current_cred(), *pcred = __task_cred(p);
 
-       if (pcred->user_ns == cred->user_ns &&
-           (pcred->uid  == cred->euid ||
-            pcred->euid == cred->euid))
+       if (uid_eq(pcred->uid,  cred->euid) ||
+           uid_eq(pcred->euid, cred->euid))
                return true;
        if (ns_capable(pcred->user_ns, CAP_SYS_NICE))
                return true;
@@ -1582,13 +1581,12 @@ static int check_prlimit_permission(struct task_struct *task)
                return 0;
 
        tcred = __task_cred(task);
-       if (cred->user_ns == tcred->user_ns &&
-           (cred->uid == tcred->euid &&
-            cred->uid == tcred->suid &&
-            cred->uid == tcred->uid &&
-            cred->gid == tcred->egid &&
-            cred->gid == tcred->sgid &&
-                   cred->gid == tcred->gid))
+       if (uid_eq(cred->uid, tcred->euid) &&
+           uid_eq(cred->uid, tcred->suid) &&
+           uid_eq(cred->uid, tcred->uid)  &&
+           gid_eq(cred->gid, tcred->egid) &&
+           gid_eq(cred->gid, tcred->sgid) &&
+           gid_eq(cred->gid, tcred->gid))
                return 0;
        if (ns_capable(tcred->user_ns, CAP_SYS_RESOURCE))
                return 0;