diff options
| author | Linus Torvalds | 2021-08-31 12:16:05 -0700 |
|---|---|---|
| committer | Linus Torvalds | 2021-08-31 12:16:05 -0700 |
| commit | e55f0c439a2681a3c299bedd99ebe998049fa508 (patch) | |
| tree | feae835d9fa5ff28c274ac110c0e73055786798c /kernel | |
| parent | 67b03f93a30facabf105b8b8632e3b9b6ef9200a (diff) | |
| parent | 2863643fb8b92291a7e97ba46e342f1163595fa8 (diff) | |
Merge tag 'kernel.sys.v5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/brauner/linux
Pull set_user() update from Christian Brauner:
"This contains a single fix to set_user() which aligns permission
checks with the corresponding fork() codepath. No one involved in this
could come up with a reason for the difference.
A capable caller can already circumvent the check when they fork where
the permission checks are already for the relevant capabilities in
addition to also allowing to exceed nproc when it is the init user.
So apply the same logic to set_user()"
* tag 'kernel.sys.v5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/brauner/linux:
set_user: add capability check when rlimit(RLIMIT_NPROC) exceeds
Diffstat (limited to 'kernel')
| -rw-r--r-- | kernel/sys.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/kernel/sys.c b/kernel/sys.c index ef1a78f5d71c..72c7639e3c98 100644 --- a/kernel/sys.c +++ b/kernel/sys.c @@ -480,7 +480,8 @@ static int set_user(struct cred *new) * failure to the execve() stage. */ if (is_ucounts_overlimit(new->ucounts, UCOUNT_RLIMIT_NPROC, rlimit(RLIMIT_NPROC)) && - new_user != INIT_USER) + new_user != INIT_USER && + !capable(CAP_SYS_RESOURCE) && !capable(CAP_SYS_ADMIN)) current->flags |= PF_NPROC_EXCEEDED; else current->flags &= ~PF_NPROC_EXCEEDED; |