Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1722073

[RESEND PATCH] Allow passing tid or pid in SCM_CREDENTIALS without CAP_SYS_ADMIN

Show all headers | View raw

Currently passing tid(gettid(2)) of a thread in struct ucred in
SCM_CREDENTIALS message requires CAP_SYS_ADMIN capability otherwise
it fails with EPERM error. Some applications deal with thread id
of a thread(tid) and so it would help to allow tid in SCM_CREDENTIALS
message. Basically, either tgid(pid of the process) or the tid of
the thread should be allowed without the need for CAP_SYS_ADMIN capability.

SCM_CREDENTIALS will be used to determine the global id of a process or
a thread running inside a pid namespace.

This patch adds necessary check to accept tid in SCM_CREDENTIALS
struct ucred.

Signed-off-by: Prakash Sangappa <prakash.sangappa@oracle.com>
---
 net/core/scm.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/net/core/scm.c b/net/core/scm.c
index b1ff8a4..9274197 100644
--- a/net/core/scm.c
+++ b/net/core/scm.c
@@ -55,6 +55,7 @@ static __inline__ int scm_check_creds(struct ucred *creds)
 		return -EINVAL;
 
 	if ((creds->pid == task_tgid_vnr(current) ||
+	     creds->pid == task_pid_vnr(current) ||
 	     ns_capable(task_active_pid_ns(current)->user_ns, CAP_SYS_ADMIN)) &&
 	    ((uid_eq(uid, cred->uid)   || uid_eq(uid, cred->euid) ||
 	      uid_eq(uid, cred->suid)) || ns_capable(cred->user_ns, CAP_SETUID)) &&
-- 
2.7.4

Back to linux.kernel | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

[RESEND PATCH] Allow passing tid or pid in SCM_CREDENTIALS without CAP_SYS_ADMIN Prakash Sangappa <prakash.sangappa@oracle.com> - 2017-08-29 02:20 +0200
  Re: [RESEND PATCH] Allow passing tid or pid in SCM_CREDENTIALS  without CAP_SYS_ADMIN David Miller <davem@davemloft.net> - 2017-08-30 01:10 +0200
    Re: [RESEND PATCH] Allow passing tid or pid in SCM_CREDENTIALS  without CAP_SYS_ADMIN "prakash.sangappa" <prakash.sangappa@oracle.com> - 2017-08-30 02:10 +0200
      Re: [RESEND PATCH] Allow passing tid or pid in SCM_CREDENTIALS without CAP_SYS_ADMIN ebiederm@xmission.com (Eric W. Biederman) - 2017-08-30 02:20 +0200
        Re: [RESEND PATCH] Allow passing tid or pid in SCM_CREDENTIALS without CAP_SYS_ADMIN ebiederm@xmission.com (Eric W. Biederman) - 2017-08-30 19:50 +0200
          Re: [RESEND PATCH] Allow passing tid or pid in SCM_CREDENTIALS  without CAP_SYS_ADMIN Prakash Sangappa <prakash.sangappa@oracle.com> - 2017-09-01 19:40 +0200
            Re: [RESEND PATCH] Allow passing tid or pid in SCM_CREDENTIALS without CAP_SYS_ADMIN ebiederm@xmission.com (Eric W. Biederman) - 2017-09-01 21:30 +0200

csiph-web