diff options
| author | Jason Gunthorpe <jgg@nvidia.com> | 2021-12-14 20:18:48 -0400 |
|---|---|---|
| committer | Jason Gunthorpe <jgg@nvidia.com> | 2021-12-14 20:18:48 -0400 |
| commit | 4922f0920966c28d674b03479cdcb7f3939bfbbd (patch) | |
| tree | 6a8b3972ff853fc0addcfab662d33354124f7fdb /block/ioprio.c | |
| parent | 20679094a0161c94faf77e373fa3f7428a8e14bd (diff) | |
| parent | 2585cf9dfaaddf00b069673f27bb3f8530e2039c (diff) | |
Merge tag 'v5.16-rc5' into rdma.git for-next
Required due to dependencies in following patches.
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Diffstat (limited to 'block/ioprio.c')
| -rw-r--r-- | block/ioprio.c | 12 |
1 files changed, 11 insertions, 1 deletions
diff --git a/block/ioprio.c b/block/ioprio.c index 0e4ff245f2bf..6f01d35a5145 100644 --- a/block/ioprio.c +++ b/block/ioprio.c @@ -69,7 +69,14 @@ int ioprio_check_cap(int ioprio) switch (class) { case IOPRIO_CLASS_RT: - if (!capable(CAP_SYS_NICE) && !capable(CAP_SYS_ADMIN)) + /* + * Originally this only checked for CAP_SYS_ADMIN, + * which was implicitly allowed for pid 0 by security + * modules such as SELinux. Make sure we check + * CAP_SYS_ADMIN first to avoid a denial/avc for + * possibly missing CAP_SYS_NICE permission. + */ + if (!capable(CAP_SYS_ADMIN) && !capable(CAP_SYS_NICE)) return -EPERM; fallthrough; /* rt has prio field too */ @@ -213,6 +220,7 @@ SYSCALL_DEFINE2(ioprio_get, int, which, int, who) pgrp = task_pgrp(current); else pgrp = find_vpid(who); + read_lock(&tasklist_lock); do_each_pid_thread(pgrp, PIDTYPE_PGID, p) { tmpio = get_task_ioprio(p); if (tmpio < 0) @@ -222,6 +230,8 @@ SYSCALL_DEFINE2(ioprio_get, int, which, int, who) else ret = ioprio_best(ret, tmpio); } while_each_pid_thread(pgrp, PIDTYPE_PGID, p); + read_unlock(&tasklist_lock); + break; case IOPRIO_WHO_USER: uid = make_kuid(current_user_ns(), who); |