diff options
| author | Michal Koutný <[email protected]> | 2022-02-17 17:11:28 +0100 |
|---|---|---|
| committer | Tejun Heo <[email protected]> | 2022-02-22 08:12:22 -1000 |
| commit | 467a726b754f474936980da793b4ff2ec3e382a7 (patch) | |
| tree | 00d3a89a6a4611e171e8122095861e9f77259ebf /lib/test_fortify/write_overflow-strlcpy-src.c | |
| parent | 6d3971dab239e7db1691690a02ce6becf30689cb (diff) | |
cgroup-v1: Correct privileges check in release_agent writes
The idea is to check: a) the owning user_ns of cgroup_ns, b)
capabilities in init_user_ns.
The commit 24f600856418 ("cgroup-v1: Require capabilities to set
release_agent") got this wrong in the write handler of release_agent
since it checked user_ns of the opener (may be different from the owning
user_ns of cgroup_ns).
Secondly, to avoid possibly confused deputy, the capability of the
opener must be checked.
Fixes: 24f600856418 ("cgroup-v1: Require capabilities to set release_agent")
Cc: [email protected]
Link: https://lore.kernel.org/stable/[email protected]/
Signed-off-by: Michal Koutný <[email protected]>
Reviewed-by: Masami Ichikawa(CIP) <[email protected]>
Signed-off-by: Tejun Heo <[email protected]>
Diffstat (limited to 'lib/test_fortify/write_overflow-strlcpy-src.c')
0 files changed, 0 insertions, 0 deletions