Commit b9a3db92 authored by Adrian Reber's avatar Adrian Reber Committed by Christian Brauner

pid_namespace: use checkpoint_restore_ns_capable() for ns_last_pid

Use the newly introduced capability CAP_CHECKPOINT_RESTORE to allow
writing to ns_last_pid.
Signed-off-by: default avatarAdrian Reber <areber@redhat.com>
Signed-off-by: default avatarNicolas Viennot <Nicolas.Viennot@twosigma.com>
Reviewed-by: default avatarSerge Hallyn <serge@hallyn.com>
Acked-by: default avatarChristian Brauner <christian.brauner@ubuntu.com>
Link: https://lore.kernel.org/r/20200719100418.2112740-4-areber@redhat.comSigned-off-by: default avatarChristian Brauner <christian.brauner@ubuntu.com>
parent 1caef81d
...@@ -269,7 +269,7 @@ static int pid_ns_ctl_handler(struct ctl_table *table, int write, ...@@ -269,7 +269,7 @@ static int pid_ns_ctl_handler(struct ctl_table *table, int write,
struct ctl_table tmp = *table; struct ctl_table tmp = *table;
int ret, next; int ret, next;
if (write && !ns_capable(pid_ns->user_ns, CAP_SYS_ADMIN)) if (write && !checkpoint_restore_ns_capable(pid_ns->user_ns))
return -EPERM; return -EPERM;
/* /*
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment