From: Eric W. Biederman <ebiederm@xmission.com>
Date: Tue, 2 Jul 2013 17:04:54 +0000 (-0700)
Subject: userns: Allow PR_CAPBSET_DROP in a user namespace.
X-Git-Tag: submit/tizen_common/20140630.083047~359
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=b92b2a4a296a6d3b453ea474b1d64baee3a50fb8;p=platform%2Fkernel%2Flinux-3.10.git

userns: Allow PR_CAPBSET_DROP in a user namespace.

As the capabilites and capability bounding set are per user namespace
properties it is safe to allow changing them with just CAP_SETPCAP
permission in the user namespace.

Change-Id: I65d5c6ef80d4196cc6b8cbc86a9661764c5b3ab1
Acked-by: Serge Hallyn <serge.hallyn@canonical.com>
Tested-by: Richard Weinberger <richard@nod.at>
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: Dariusz Michaluk <d.michaluk@samsung.com>
---

diff --git a/security/commoncap.c b/security/commoncap.c
index c44b6fe..9fccf71 100644
--- a/security/commoncap.c
+++ b/security/commoncap.c
@@ -824,7 +824,7 @@ int cap_task_setnice(struct task_struct *p, int nice)
  */
 static long cap_prctl_drop(struct cred *new, unsigned long cap)
 {
-	if (!capable(CAP_SETPCAP))
+	if (!ns_capable(current_user_ns(), CAP_SETPCAP))
 		return -EPERM;
 	if (!cap_valid(cap))
 		return -EINVAL;