diff options
-rw-r--r-- | kernel/ptrace.c | 13 | ||||
-rw-r--r-- | kernel/signal.c | 15 | ||||
-rw-r--r-- | kernel/sys.c | 18 |
3 files changed, 20 insertions, 26 deletions
diff --git a/kernel/ptrace.c b/kernel/ptrace.c index 24e0a5a94824..a232bb59d93f 100644 --- a/kernel/ptrace.c +++ b/kernel/ptrace.c | |||
@@ -198,13 +198,12 @@ int __ptrace_may_access(struct task_struct *task, unsigned int mode) | |||
198 | return 0; | 198 | return 0; |
199 | rcu_read_lock(); | 199 | rcu_read_lock(); |
200 | tcred = __task_cred(task); | 200 | tcred = __task_cred(task); |
201 | if (cred->user_ns == tcred->user_ns && | 201 | if (uid_eq(cred->uid, tcred->euid) && |
202 | (cred->uid == tcred->euid && | 202 | uid_eq(cred->uid, tcred->suid) && |
203 | cred->uid == tcred->suid && | 203 | uid_eq(cred->uid, tcred->uid) && |
204 | cred->uid == tcred->uid && | 204 | gid_eq(cred->gid, tcred->egid) && |
205 | cred->gid == tcred->egid && | 205 | gid_eq(cred->gid, tcred->sgid) && |
206 | cred->gid == tcred->sgid && | 206 | gid_eq(cred->gid, tcred->gid)) |
207 | cred->gid == tcred->gid)) | ||
208 | goto ok; | 207 | goto ok; |
209 | if (ptrace_has_cap(tcred->user_ns, mode)) | 208 | if (ptrace_has_cap(tcred->user_ns, mode)) |
210 | goto ok; | 209 | goto ok; |
diff --git a/kernel/signal.c b/kernel/signal.c index d6303277a640..aef629c65c87 100644 --- a/kernel/signal.c +++ b/kernel/signal.c | |||
@@ -767,11 +767,10 @@ static int kill_ok_by_cred(struct task_struct *t) | |||
767 | const struct cred *cred = current_cred(); | 767 | const struct cred *cred = current_cred(); |
768 | const struct cred *tcred = __task_cred(t); | 768 | const struct cred *tcred = __task_cred(t); |
769 | 769 | ||
770 | if (cred->user_ns == tcred->user_ns && | 770 | if (uid_eq(cred->euid, tcred->suid) || |
771 | (cred->euid == tcred->suid || | 771 | uid_eq(cred->euid, tcred->uid) || |
772 | cred->euid == tcred->uid || | 772 | uid_eq(cred->uid, tcred->suid) || |
773 | cred->uid == tcred->suid || | 773 | uid_eq(cred->uid, tcred->uid)) |
774 | cred->uid == tcred->uid)) | ||
775 | return 1; | 774 | return 1; |
776 | 775 | ||
777 | if (ns_capable(tcred->user_ns, CAP_KILL)) | 776 | if (ns_capable(tcred->user_ns, CAP_KILL)) |
@@ -1389,10 +1388,8 @@ static int kill_as_cred_perm(const struct cred *cred, | |||
1389 | struct task_struct *target) | 1388 | struct task_struct *target) |
1390 | { | 1389 | { |
1391 | const struct cred *pcred = __task_cred(target); | 1390 | const struct cred *pcred = __task_cred(target); |
1392 | if (cred->user_ns != pcred->user_ns) | 1391 | if (!uid_eq(cred->euid, pcred->suid) && !uid_eq(cred->euid, pcred->uid) && |
1393 | return 0; | 1392 | !uid_eq(cred->uid, pcred->suid) && !uid_eq(cred->uid, pcred->uid)) |
1394 | if (cred->euid != pcred->suid && cred->euid != pcred->uid && | ||
1395 | cred->uid != pcred->suid && cred->uid != pcred->uid) | ||
1396 | return 0; | 1393 | return 0; |
1397 | return 1; | 1394 | return 1; |
1398 | } | 1395 | } |
diff --git a/kernel/sys.c b/kernel/sys.c index aff09f208eb3..f484077b6b14 100644 --- a/kernel/sys.c +++ b/kernel/sys.c | |||
@@ -131,9 +131,8 @@ static bool set_one_prio_perm(struct task_struct *p) | |||
131 | { | 131 | { |
132 | const struct cred *cred = current_cred(), *pcred = __task_cred(p); | 132 | const struct cred *cred = current_cred(), *pcred = __task_cred(p); |
133 | 133 | ||
134 | if (pcred->user_ns == cred->user_ns && | 134 | if (uid_eq(pcred->uid, cred->euid) || |
135 | (pcred->uid == cred->euid || | 135 | uid_eq(pcred->euid, cred->euid)) |
136 | pcred->euid == cred->euid)) | ||
137 | return true; | 136 | return true; |
138 | if (ns_capable(pcred->user_ns, CAP_SYS_NICE)) | 137 | if (ns_capable(pcred->user_ns, CAP_SYS_NICE)) |
139 | return true; | 138 | return true; |
@@ -1582,13 +1581,12 @@ static int check_prlimit_permission(struct task_struct *task) | |||
1582 | return 0; | 1581 | return 0; |
1583 | 1582 | ||
1584 | tcred = __task_cred(task); | 1583 | tcred = __task_cred(task); |
1585 | if (cred->user_ns == tcred->user_ns && | 1584 | if (uid_eq(cred->uid, tcred->euid) && |
1586 | (cred->uid == tcred->euid && | 1585 | uid_eq(cred->uid, tcred->suid) && |
1587 | cred->uid == tcred->suid && | 1586 | uid_eq(cred->uid, tcred->uid) && |
1588 | cred->uid == tcred->uid && | 1587 | gid_eq(cred->gid, tcred->egid) && |
1589 | cred->gid == tcred->egid && | 1588 | gid_eq(cred->gid, tcred->sgid) && |
1590 | cred->gid == tcred->sgid && | 1589 | gid_eq(cred->gid, tcred->gid)) |
1591 | cred->gid == tcred->gid)) | ||
1592 | return 0; | 1590 | return 0; |
1593 | if (ns_capable(tcred->user_ns, CAP_SYS_RESOURCE)) | 1591 | if (ns_capable(tcred->user_ns, CAP_SYS_RESOURCE)) |
1594 | return 0; | 1592 | return 0; |