From: Kees Cook Date: Mon, 14 May 2012 17:19:28 +0000 (-0700) Subject: Yama: replace capable() with ns_capable() X-Git-Url: https://git.karo-electronics.de/?a=commitdiff_plain;h=2cc8a71641b4460783ea3bd7a3476043fdf85397;p=linux-beck.git Yama: replace capable() with ns_capable() When checking capabilities, the question we want to be asking is "does current() have the capability in the child's namespace?" Signed-off-by: Kees Cook Signed-off-by: James Morris --- diff --git a/security/yama/yama_lsm.c b/security/yama/yama_lsm.c index c852f7472ad0..83554ee8a587 100644 --- a/security/yama/yama_lsm.c +++ b/security/yama/yama_lsm.c @@ -264,11 +264,11 @@ static int yama_ptrace_access_check(struct task_struct *child, case YAMA_SCOPE_RELATIONAL: if (!task_is_descendant(current, child) && !ptracer_exception_found(current, child) && - !capable(CAP_SYS_PTRACE)) + !ns_capable(task_user_ns(child), CAP_SYS_PTRACE)) rc = -EPERM; break; case YAMA_SCOPE_CAPABILITY: - if (!capable(CAP_SYS_PTRACE)) + if (!ns_capable(task_user_ns(child), CAP_SYS_PTRACE)) rc = -EPERM; break; case YAMA_SCOPE_NO_ATTACH: