diff options
| author | Michal Koutný | 2022-02-17 17:11:28 +0100 |
|---|---|---|
| committer | Tejun Heo | 2022-02-22 08:12:22 -1000 |
| commit | 467a726b754f474936980da793b4ff2ec3e382a7 (patch) | |
| tree | 00d3a89a6a4611e171e8122095861e9f77259ebf /security | |
| parent | 6d3971dab239e7db1691690a02ce6becf30689cb (diff) | |
cgroup-v1: Correct privileges check in release_agent writes
The idea is to check: a) the owning user_ns of cgroup_ns, b)
capabilities in init_user_ns.
The commit 24f600856418 ("cgroup-v1: Require capabilities to set
release_agent") got this wrong in the write handler of release_agent
since it checked user_ns of the opener (may be different from the owning
user_ns of cgroup_ns).
Secondly, to avoid possibly confused deputy, the capability of the
opener must be checked.
Fixes: 24f600856418 ("cgroup-v1: Require capabilities to set release_agent")
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/stable/20220216121142.GB30035@blackbody.suse.cz/
Signed-off-by: Michal Koutný <mkoutny@suse.com>
Reviewed-by: Masami Ichikawa(CIP) <masami.ichikawa@cybertrust.co.jp>
Signed-off-by: Tejun Heo <tj@kernel.org>
Diffstat (limited to 'security')
0 files changed, 0 insertions, 0 deletions