From patchwork Wed Aug 7 07:37:09 2013 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Rui Xiang X-Patchwork-Id: 265374 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id F16D82C01FD for ; Wed, 7 Aug 2013 17:39:50 +1000 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932309Ab3HGHiC (ORCPT ); Wed, 7 Aug 2013 03:38:02 -0400 Received: from szxga03-in.huawei.com ([119.145.14.66]:44921 "EHLO szxga03-in.huawei.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932239Ab3HGHiA (ORCPT ); Wed, 7 Aug 2013 03:38:00 -0400 Received: from 172.24.2.119 (EHLO szxeml209-edg.china.huawei.com) ([172.24.2.119]) by szxrg03-dlp.huawei.com (MOS 4.4.2a-FCS FastPath queued) with ESMTP id ACY79076; Wed, 07 Aug 2013 15:37:51 +0800 (CST) Received: from SZXEML451-HUB.china.huawei.com (10.82.67.194) by szxeml209-edg.china.huawei.com (172.24.2.184) with Microsoft SMTP Server (TLS) id 14.1.323.7; Wed, 7 Aug 2013 15:37:46 +0800 Received: from localhost (10.135.72.188) by szxeml451-hub.china.huawei.com (10.82.67.194) with Microsoft SMTP Server id 14.1.323.7; Wed, 7 Aug 2013 15:37:24 +0800 From: Rui Xiang To: , CC: , , , , , , , , Rui Xiang Subject: [PATCH v3 05/11] syslog_ns: make permisiion check per user namespace Date: Wed, 7 Aug 2013 15:37:09 +0800 Message-ID: <1375861035-24320-6-git-send-email-rui.xiang@huawei.com> X-Mailer: git-send-email 1.8.1.msysgit.1 In-Reply-To: <1375861035-24320-1-git-send-email-rui.xiang@huawei.com> References: <1375861035-24320-1-git-send-email-rui.xiang@huawei.com> MIME-Version: 1.0 X-Originating-IP: [10.135.72.188] X-CFilter-Loop: Reflected Sender: netfilter-devel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netfilter-devel@vger.kernel.org Use ns_capable to check capability in user ns, instead of capable function. The user ns is the owner of current syslog ns. Signed-off-by: Rui Xiang --- kernel/printk.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/kernel/printk.c b/kernel/printk.c index e508ab2..ca951e7 100644 --- a/kernel/printk.c +++ b/kernel/printk.c @@ -374,13 +374,13 @@ static int check_syslog_permissions(int type, bool from_file, return 0; if (syslog_action_restricted(type, ns)) { - if (capable(CAP_SYSLOG)) + if (ns_capable(ns->owner, CAP_SYSLOG)) return 0; /* * For historical reasons, accept CAP_SYS_ADMIN too, with * a warning. */ - if (capable(CAP_SYS_ADMIN)) { + if (ns_capable(ns->owner, CAP_SYS_ADMIN)) { pr_warn_once("%s (%d): Attempt to access syslog with " "CAP_SYS_ADMIN but no CAP_SYSLOG " "(deprecated).\n",