aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--kernel/ptrace.c13
-rw-r--r--kernel/signal.c15
-rw-r--r--kernel/sys.c18
3 files changed, 20 insertions, 26 deletions
diff --git a/kernel/ptrace.c b/kernel/ptrace.c
index 24e0a5a94824..a232bb59d93f 100644
--- a/kernel/ptrace.c
+++ b/kernel/ptrace.c
@@ -198,13 +198,12 @@ int __ptrace_may_access(struct task_struct *task, unsigned int mode)
198 return 0; 198 return 0;
199 rcu_read_lock(); 199 rcu_read_lock();
200 tcred = __task_cred(task); 200 tcred = __task_cred(task);
201 if (cred->user_ns == tcred->user_ns && 201 if (uid_eq(cred->uid, tcred->euid) &&
202 (cred->uid == tcred->euid && 202 uid_eq(cred->uid, tcred->suid) &&
203 cred->uid == tcred->suid && 203 uid_eq(cred->uid, tcred->uid) &&
204 cred->uid == tcred->uid && 204 gid_eq(cred->gid, tcred->egid) &&
205 cred->gid == tcred->egid && 205 gid_eq(cred->gid, tcred->sgid) &&
206 cred->gid == tcred->sgid && 206 gid_eq(cred->gid, tcred->gid))
207 cred->gid == tcred->gid))
208 goto ok; 207 goto ok;
209 if (ptrace_has_cap(tcred->user_ns, mode)) 208 if (ptrace_has_cap(tcred->user_ns, mode))
210 goto ok; 209 goto ok;
diff --git a/kernel/signal.c b/kernel/signal.c
index d6303277a640..aef629c65c87 100644
--- a/kernel/signal.c
+++ b/kernel/signal.c
@@ -767,11 +767,10 @@ static int kill_ok_by_cred(struct task_struct *t)
767 const struct cred *cred = current_cred(); 767 const struct cred *cred = current_cred();
768 const struct cred *tcred = __task_cred(t); 768 const struct cred *tcred = __task_cred(t);
769 769
770 if (cred->user_ns == tcred->user_ns && 770 if (uid_eq(cred->euid, tcred->suid) ||
771 (cred->euid == tcred->suid || 771 uid_eq(cred->euid, tcred->uid) ||
772 cred->euid == tcred->uid || 772 uid_eq(cred->uid, tcred->suid) ||
773 cred->uid == tcred->suid || 773 uid_eq(cred->uid, tcred->uid))
774 cred->uid == tcred->uid))
775 return 1; 774 return 1;
776 775
777 if (ns_capable(tcred->user_ns, CAP_KILL)) 776 if (ns_capable(tcred->user_ns, CAP_KILL))
@@ -1389,10 +1388,8 @@ static int kill_as_cred_perm(const struct cred *cred,
1389 struct task_struct *target) 1388 struct task_struct *target)
1390{ 1389{
1391 const struct cred *pcred = __task_cred(target); 1390 const struct cred *pcred = __task_cred(target);
1392 if (cred->user_ns != pcred->user_ns) 1391 if (!uid_eq(cred->euid, pcred->suid) && !uid_eq(cred->euid, pcred->uid) &&
1393 return 0; 1392 !uid_eq(cred->uid, pcred->suid) && !uid_eq(cred->uid, pcred->uid))
1394 if (cred->euid != pcred->suid && cred->euid != pcred->uid &&
1395 cred->uid != pcred->suid && cred->uid != pcred->uid)
1396 return 0; 1393 return 0;
1397 return 1; 1394 return 1;
1398} 1395}
diff --git a/kernel/sys.c b/kernel/sys.c
index aff09f208eb3..f484077b6b14 100644
--- a/kernel/sys.c
+++ b/kernel/sys.c
@@ -131,9 +131,8 @@ static bool set_one_prio_perm(struct task_struct *p)
131{ 131{
132 const struct cred *cred = current_cred(), *pcred = __task_cred(p); 132 const struct cred *cred = current_cred(), *pcred = __task_cred(p);
133 133
134 if (pcred->user_ns == cred->user_ns && 134 if (uid_eq(pcred->uid, cred->euid) ||
135 (pcred->uid == cred->euid || 135 uid_eq(pcred->euid, cred->euid))
136 pcred->euid == cred->euid))
137 return true; 136 return true;
138 if (ns_capable(pcred->user_ns, CAP_SYS_NICE)) 137 if (ns_capable(pcred->user_ns, CAP_SYS_NICE))
139 return true; 138 return true;
@@ -1582,13 +1581,12 @@ static int check_prlimit_permission(struct task_struct *task)
1582 return 0; 1581 return 0;
1583 1582
1584 tcred = __task_cred(task); 1583 tcred = __task_cred(task);
1585 if (cred->user_ns == tcred->user_ns && 1584 if (uid_eq(cred->uid, tcred->euid) &&
1586 (cred->uid == tcred->euid && 1585 uid_eq(cred->uid, tcred->suid) &&
1587 cred->uid == tcred->suid && 1586 uid_eq(cred->uid, tcred->uid) &&
1588 cred->uid == tcred->uid && 1587 gid_eq(cred->gid, tcred->egid) &&
1589 cred->gid == tcred->egid && 1588 gid_eq(cred->gid, tcred->sgid) &&
1590 cred->gid == tcred->sgid && 1589 gid_eq(cred->gid, tcred->gid))
1591 cred->gid == tcred->gid))
1592 return 0; 1590 return 0;
1593 if (ns_capable(tcred->user_ns, CAP_SYS_RESOURCE)) 1591 if (ns_capable(tcred->user_ns, CAP_SYS_RESOURCE))
1594 return 0; 1592 return 0;