* [RFC] [PATCH] capset returns -EPERM when pid==current->pid
@ 2005-01-04 16:53 Serge E. Hallyn
2005-01-04 20:23 ` Chris Wright
0 siblings, 1 reply; 2+ messages in thread
From: Serge E. Hallyn @ 2005-01-04 16:53 UTC (permalink / raw)
To: linux-kernel, Chris Wright
In the current kernel/capability.c:sys_capset() code, permission is
denied if CAP_SETPCAP is not held and pid is positive. pid=0 means use
the current process, and this is allowed. But using the current
process' pid is not allowed. The man page for capsetp simply says that
CAP_SETPCAP is required to use this function, and does not mention the
exception for pid=0.
The current behavior seems inconsistent. The attached patch also
allows a process to call capset() on itself. Does this seem reasonable?
thanks,
-serge
Index: linux-2.6.10-mm1/kernel/capability.c
===================================================================
--- linux-2.6.10-mm1.orig/kernel/capability.c 2005-01-04 11:51:21.000000000 -0600
+++ linux-2.6.10-mm1/kernel/capability.c 2005-01-04 11:52:58.000000000 -0600
@@ -147,7 +147,7 @@ asmlinkage long sys_capset(cap_user_head
if (get_user(pid, &header->pid))
return -EFAULT;
- if (pid && !capable(CAP_SETPCAP))
+ if (pid && pid != current->pid && !capable(CAP_SETPCAP))
return -EPERM;
if (copy_from_user(&effective, &data->effective, sizeof(effective)) ||
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: [RFC] [PATCH] capset returns -EPERM when pid==current->pid
2005-01-04 16:53 [RFC] [PATCH] capset returns -EPERM when pid==current->pid Serge E. Hallyn
@ 2005-01-04 20:23 ` Chris Wright
0 siblings, 0 replies; 2+ messages in thread
From: Chris Wright @ 2005-01-04 20:23 UTC (permalink / raw)
To: akpm, Serge E. Hallyn; +Cc: linux-kernel, Chris Wright
* Serge E. Hallyn (serue@us.ibm.com) wrote:
> In the current kernel/capability.c:sys_capset() code, permission is
> denied if CAP_SETPCAP is not held and pid is positive. pid=0 means use
> the current process, and this is allowed. But using the current
> process' pid is not allowed. The man page for capsetp simply says that
> CAP_SETPCAP is required to use this function, and does not mention the
> exception for pid=0.
>
> The current behavior seems inconsistent. The attached patch also
> allows a process to call capset() on itself. Does this seem reasonable?
Yes.
From: Serge E. Hallyn <serue@us.ibm.com>
Signed-off-by: Chris Wright <chrisw@osdl.org>
Index: linux-2.6.10-mm1/kernel/capability.c
===================================================================
--- linux-2.6.10-mm1.orig/kernel/capability.c 2005-01-04 11:51:21.000000000 -0600
+++ linux-2.6.10-mm1/kernel/capability.c 2005-01-04 11:52:58.000000000 -0600
@@ -147,7 +147,7 @@ asmlinkage long sys_capset(cap_user_head
if (get_user(pid, &header->pid))
return -EFAULT;
- if (pid && !capable(CAP_SETPCAP))
+ if (pid && pid != current->pid && !capable(CAP_SETPCAP))
return -EPERM;
if (copy_from_user(&effective, &data->effective, sizeof(effective)) ||
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2005-01-04 20:31 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2005-01-04 16:53 [RFC] [PATCH] capset returns -EPERM when pid==current->pid Serge E. Hallyn
2005-01-04 20:23 ` Chris Wright
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).