[rh7] net/scm/creds: drop redundant check for pid against init userns in scm_check_creds()

Submitted by Konstantin Khorenko on Dec. 15, 2017, 11:49 p.m.

Details

Message ID 20171215234927.5299-1-khorenko@virtuozzo.com
State New
Series "net/scm/creds: drop redundant check for pid against init userns in scm_check_creds()"
Headers show

Commit Message

Konstantin Khorenko Dec. 15, 2017, 11:49 p.m.
Normally scm_check_creds() checks if received pid equals to "current" pid in
current userns and our additional check for equality to "current" pid in init
userns seems to be a leftover:

in 2.6.18-x we had the following patch:
 static __inline__ int scm_check_creds(struct ucred *creds)
 {
-       if ((creds->pid == current->tgid || capable(CAP_SYS_ADMIN)) &&
+       if ((creds->pid == virt_tgid(current) ||
+            creds->pid == current->tgid ||
+            capable(CAP_VE_SYS_ADMIN)) &&

while mainstream patch:

commit b488893a390edfe027bae7a46e9af8083e740668
Author: Pavel Emelyanov <xemul@openvz.org>
Date:   Thu Oct 18 23:40:14 2007 -0700

    pid namespaces: changes to show virtual ids to user

 static __inline__ int scm_check_creds(struct ucred *creds)
 {
-       if ((creds->pid == current->tgid || capable(CAP_SYS_ADMIN)) &&
+       if ((creds->pid == task_tgid_vnr(current) || capable(CAP_SYS_ADMIN)) &&

Signed-off-by: Konstantin Khorenko <khorenko@virtuozzo.com>
---
 net/core/scm.c | 1 -
 1 file changed, 1 deletion(-)

Patch hide | download patch | download mbox

diff --git a/net/core/scm.c b/net/core/scm.c
index cecf199..23c7eab 100644
--- a/net/core/scm.c
+++ b/net/core/scm.c
@@ -54,7 +54,6 @@  static __inline__ int scm_check_creds(struct ucred *creds)
 		return -EINVAL;
 
 	if ((creds->pid == task_tgid_vnr(current) ||
-	     creds->pid == current->tgid ||
 	     ns_capable(task_active_pid_ns(current)->user_ns, CAP_SYS_ADMIN)) &&
 	    ((uid_eq(uid, cred->uid)   || uid_eq(uid, cred->euid) ||
 	      uid_eq(uid, cred->suid)) || ns_capable(cred->user_ns, CAP_SETUID)) &&

Comments

Kirill Tkhai Dec. 18, 2017, 8:12 a.m.
On 16.12.2017 02:49, Konstantin Khorenko wrote:
> Normally scm_check_creds() checks if received pid equals to "current" pid in
> current userns and our additional check for equality to "current" pid in init
> userns seems to be a leftover:
> 
> in 2.6.18-x we had the following patch:
>  static __inline__ int scm_check_creds(struct ucred *creds)
>  {
> -       if ((creds->pid == current->tgid || capable(CAP_SYS_ADMIN)) &&
> +       if ((creds->pid == virt_tgid(current) ||
> +            creds->pid == current->tgid ||
> +            capable(CAP_VE_SYS_ADMIN)) &&
> 
> while mainstream patch:
> 
> commit b488893a390edfe027bae7a46e9af8083e740668
> Author: Pavel Emelyanov <xemul@openvz.org>
> Date:   Thu Oct 18 23:40:14 2007 -0700
> 
>     pid namespaces: changes to show virtual ids to user
> 
>  static __inline__ int scm_check_creds(struct ucred *creds)
>  {
> -       if ((creds->pid == current->tgid || capable(CAP_SYS_ADMIN)) &&
> +       if ((creds->pid == task_tgid_vnr(current) || capable(CAP_SYS_ADMIN)) &&
> 
> Signed-off-by: Konstantin Khorenko <khorenko@virtuozzo.com>

Reviewed-by: Kirill Tkhai <ktkhai@virtuozzo.com>

> ---
>  net/core/scm.c | 1 -
>  1 file changed, 1 deletion(-)
> 
> diff --git a/net/core/scm.c b/net/core/scm.c
> index cecf199..23c7eab 100644
> --- a/net/core/scm.c
> +++ b/net/core/scm.c
> @@ -54,7 +54,6 @@ static __inline__ int scm_check_creds(struct ucred *creds)
>  		return -EINVAL;
>  
>  	if ((creds->pid == task_tgid_vnr(current) ||
> -	     creds->pid == current->tgid ||
>  	     ns_capable(task_active_pid_ns(current)->user_ns, CAP_SYS_ADMIN)) &&
>  	    ((uid_eq(uid, cred->uid)   || uid_eq(uid, cred->euid) ||
>  	      uid_eq(uid, cred->suid)) || ns_capable(cred->user_ns, CAP_SETUID)) &&
>