diff options
| author |   Todd Poynor <toddpoynor@google.com> | 2018-07-29 12:36:37 -0700 |
|---|---|---|
| committer |   Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2018-07-30 10:54:50 +0200 |
| commit | f9a4963019291b8ea7f2bb473b2caa7ff2238633 (patch) | |
| tree | 6eee39456669ed74c114f33dff5a3c6a9acb500f /drivers/staging/gasket | |
| parent | staging: gasket: page table: hold references to device and pci_dev (diff) | |
| download | linux-dev-f9a4963019291b8ea7f2bb473b2caa7ff2238633.tar.xz linux-dev-f9a4963019291b8ea7f2bb473b2caa7ff2238633.zip | |
staging: gasket: core: allow root access based on user namespace
Use user namespace to determine whether gasket device file opener is
root, allowing root access to containers, if necessary.
Reported-by: Dmitry Torokhov <dtor@chromium.org>
Signed-off-by: Todd Poynor <toddpoynor@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/staging/gasket')
| -rw-r--r-- | drivers/staging/gasket/gasket_core.c | 10 |
1 files changed, 8 insertions, 2 deletions
diff --git a/drivers/staging/gasket/gasket_core.c b/drivers/staging/gasket/gasket_core.c index b832a4f529f2..291cd6d074a2 100644 --- a/drivers/staging/gasket/gasket_core.c +++ b/drivers/staging/gasket/gasket_core.c @@ -13,13 +13,16 @@ #include "gasket_page_table.h" #include "gasket_sysfs.h" +#include <linux/capability.h> #include <linux/compiler.h> #include <linux/delay.h> #include <linux/device.h> #include <linux/fs.h> #include <linux/init.h> #include <linux/of.h> +#include <linux/pid_namespace.h> #include <linux/printk.h> +#include <linux/sched.h> #ifdef GASKET_KERNEL_TRACE_SUPPORT #define CREATE_TRACE_POINTS @@ -1064,7 +1067,8 @@ static int gasket_open(struct inode *inode, struct file *filp) char task_name[TASK_COMM_LEN]; struct gasket_cdev_info *dev_info = container_of(inode->i_cdev, struct gasket_cdev_info, cdev); - int is_root = capable(CAP_SYS_ADMIN); + struct pid_namespace *pid_ns = task_active_pid_ns(current); + int is_root = ns_capable(pid_ns->user_ns, CAP_SYS_ADMIN); gasket_dev = dev_info->gasket_dev_ptr; driver_desc = gasket_dev->internal_desc->driver_desc; @@ -1147,6 +1151,8 @@ static int gasket_release(struct inode *inode, struct file *file) char task_name[TASK_COMM_LEN]; struct gasket_cdev_info *dev_info = container_of(inode->i_cdev, struct gasket_cdev_info, cdev); + struct pid_namespace *pid_ns = task_active_pid_ns(current); + int is_root = ns_capable(pid_ns->user_ns, CAP_SYS_ADMIN); gasket_dev = dev_info->gasket_dev_ptr; driver_desc = gasket_dev->internal_desc->driver_desc; @@ -1158,7 +1164,7 @@ static int gasket_release(struct inode *inode, struct file *file) "Releasing device node. Call origin: tgid %u (%s) " "(f_mode: 0%03o, fmode_write: %d, is_root: %u)\n", current->tgid, task_name, file->f_mode, - (file->f_mode & FMODE_WRITE), capable(CAP_SYS_ADMIN)); + (file->f_mode & FMODE_WRITE), is_root); dev_dbg(gasket_dev->dev, "Current open count (owning tgid %u): %d\n", ownership->owner, ownership->write_open_count); |