aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--kernel/fork.c24
1 files changed, 9 insertions, 15 deletions
diff --git a/kernel/fork.c b/kernel/fork.c
index 68d508f2bfba..84703db06cf3 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -1173,13 +1173,16 @@ static struct task_struct *copy_process(unsigned long clone_flags,
1173 return ERR_PTR(-EINVAL); 1173 return ERR_PTR(-EINVAL);
1174 1174
1175 /* 1175 /*
1176 * If the new process will be in a different pid namespace don't 1176 * If the new process will be in a different pid or user namespace
1177 * allow it to share a thread group or signal handlers with the 1177 * do not allow it to share a thread group or signal handlers or
1178 * forking task. 1178 * parent with the forking task.
1179 */ 1179 */
1180 if ((clone_flags & CLONE_SIGHAND) && (task_active_pid_ns(current) != 1180 if (clone_flags & (CLONE_SIGHAND | CLONE_PARENT)) {
1181 current->nsproxy->pid_ns_for_children)) 1181 if ((clone_flags & (CLONE_NEWUSER | CLONE_NEWPID)) ||
1182 return ERR_PTR(-EINVAL); 1182 (task_active_pid_ns(current) !=
1183 current->nsproxy->pid_ns_for_children))
1184 return ERR_PTR(-EINVAL);
1185 }
1183 1186
1184 retval = security_task_create(clone_flags); 1187 retval = security_task_create(clone_flags);
1185 if (retval) 1188 if (retval)
@@ -1576,15 +1579,6 @@ long do_fork(unsigned long clone_flags,
1576 long nr; 1579 long nr;
1577 1580
1578 /* 1581 /*
1579 * Do some preliminary argument and permissions checking before we
1580 * actually start allocating stuff
1581 */
1582 if (clone_flags & (CLONE_NEWUSER | CLONE_NEWPID)) {
1583 if (clone_flags & (CLONE_THREAD|CLONE_PARENT))
1584 return -EINVAL;
1585 }
1586
1587 /*
1588 * Determine whether and which event to report to ptracer. When 1582 * Determine whether and which event to report to ptracer. When
1589 * called from kernel_thread or CLONE_UNTRACED is explicitly 1583 * called from kernel_thread or CLONE_UNTRACED is explicitly
1590 * requested, no event is reported; otherwise, report if the event 1584 * requested, no event is reported; otherwise, report if the event