Serge E. Hallyn b0e77598f8 userns: user namespaces: convert several capable() calls ...

CAP_IPC_OWNER and CAP_IPC_LOCK can be checked against current_user_ns(),
because the resource comes from current's own ipc namespace.

setuid/setgid are to uids in own namespace, so again checks can be against
current_user_ns().

Changelog:
	Jan 11: Use task_ns_capable() in place of sched_capable().
	Jan 11: Use nsown_capable() as suggested by Bastian Blank.
	Jan 11: Clarify (hopefully) some logic in futex and sched.c
	Feb 15: use ns_capable for ipc, not nsown_capable
	Feb 23: let copy_ipcs handle setting ipc_ns->user_ns
	Feb 23: pass ns down rather than taking it from current

[akpm@linux-foundation.org: coding-style fixes]
Signed-off-by: Serge E. Hallyn <serge.hallyn@canonical.com>
Acked-by: "Eric W. Biederman" <ebiederm@xmission.com>
Acked-by: Daniel Lezcano <daniel.lezcano@free.fr>
Acked-by: David Howells <dhowells@redhat.com>
Cc: James Morris <jmorris@namei.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

2011-03-23 19:47:08 -07:00

..

debug

Merge branch 'master' into for-next

2010-12-22 18:57:02 +01:00

gcov

Merge branch 'trivial' of git://git.kernel.org/pub/scm/linux/kernel/git/mmarek/kbuild-2.6

2011-03-20 18:14:55 -07:00

irq

genirq: Fix incorrect unlock in __setup_irq()

2011-03-17 15:52:30 +01:00

power

Merge branch 'trivial' of git://git.kernel.org/pub/scm/linux/kernel/git/mmarek/kbuild-2.6

2011-03-20 18:14:55 -07:00

time

Merge branch 'timers-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip

2011-03-15 18:53:35 -07:00

trace

Merge branch 'perf-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip

2011-03-18 10:38:34 -07:00

.gitignore

…

acct.c

pass a struct path to vfs_statfs

2010-08-09 16:48:42 -04:00

async.c

async: use workqueue for worker pool

2010-07-14 11:29:46 +02:00

audit_tree.c

in untag_chunk() we need to do alloc_chunk() a bit earlier

2010-10-30 02:18:32 -04:00

audit_watch.c

kill path_lookup()

2011-03-14 09:15:23 -04:00

audit.c

netlink: kill loginuid/sessionid/sid members from struct netlink_skb_parms

2011-03-03 10:55:40 -08:00

audit.h

audit: make functions static

2010-10-30 01:42:19 -04:00

auditfilter.c

netlink: kill loginuid/sessionid/sid members from struct netlink_skb_parms

2011-03-03 10:55:40 -08:00

auditsc.c

audit mmap

2010-10-30 08:45:43 -04:00

backtracetest.c

…

bounds.c

memcg: remove direct page_cgroup-to-page pointer

2011-03-23 19:46:28 -07:00

capability.c

userns: make has_capability* into real functions

2011-03-23 19:47:06 -07:00

cgroup_freezer.c

cgroup_freezer: update_freezer_state() does incorrect state transitions

2010-10-27 18:03:08 -07:00

cgroup.c

cgroups: if you list_empty() a head then don't list_del() it

2011-03-22 17:43:58 -07:00

compat.c

posix-timers: Introduce a syscall for clock tuning.

2011-02-02 15:28:19 +01:00

configs.c

llseek: automatically add .llseek fop

2010-10-15 15:53:27 +02:00

cpu.c

kernel/cpu.c: fix many errors related to style.

2011-03-22 17:44:11 -07:00

cpuset.c

cpuset: hold callback_mutex in cpuset_post_clone()

2011-03-23 19:46:35 -07:00

cred.c

userns: security: make capabilities relative to the user namespace

2011-03-23 19:47:02 -07:00

delayacct.c

…

dma.c

…

elfcore.c

…

exec_domain.c

sys_personality: remove the bogus checks in sys_personality()->__set_personality() path

2010-08-09 20:45:05 -07:00

exit.c

Merge branch 'perf-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip

2011-01-11 11:02:13 -08:00

extable.c

…

fork.c

pidns: call pid_ns_prepare_proc() from create_pid_namespace()

2011-03-23 19:46:58 -07:00

freezer.c

Freezer: Fix a race during freezing of TASK_STOPPED tasks

2010-12-24 15:02:40 +01:00

futex_compat.c

userns: user namespaces: convert several capable() calls

2011-03-23 19:47:08 -07:00

futex.c

userns: user namespaces: convert several capable() calls

2011-03-23 19:47:08 -07:00

groups.c

userns: user namespaces: convert several capable() calls

2011-03-23 19:47:08 -07:00

hrtimer.c

Merge branch 'timers-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip

2011-03-15 18:53:35 -07:00

hung_task.c

lockup detector: Fix grammar by adding a missing "to" in the comments

2010-08-17 09:11:52 +02:00

hw_breakpoint.c

perf: Dynamic pmu types

2010-12-16 11:36:43 +01:00

irq_work.c

irq_work: Use per cpu atomics instead of regular atomics

2010-12-18 15:54:48 +01:00

itimer.c

…

jump_label.c

jump label: Make arch_jump_label_text_poke_early() optional

2010-10-29 12:56:13 -04:00

kallsyms.c

printk: use %pK for /proc/kallsyms and /proc/modules

2011-03-22 17:44:12 -07:00

Kconfig.freezer

…

Kconfig.hz

…

Kconfig.locks

…

Kconfig.preempt

…

kexec.c

tree-wide: fix comment/printk typos

2010-11-01 15:38:34 -04:00

kfifo.c

kfifo: fix scatterlist usage

2010-10-01 10:50:58 -07:00

kmod.c

Make do_execve() take a const filename pointer

2010-08-17 18:07:43 -07:00

kprobes.c

Merge branch 'for-2.6.38' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/percpu

2011-01-07 17:02:58 -08:00

ksysfs.c

sysfs: add struct file* to bin_attr callbacks

2010-05-21 09:37:31 -07:00

kthread.c

kthread: NUMA aware kthread_create_on_node()

2011-03-22 17:44:01 -07:00

latencytop.c

fs/proc/base.c, kernel/latencytop.c: convert sprintf_symbol() to %ps

2011-01-13 08:03:16 -08:00

lockdep_internals.h

…

lockdep_proc.c

locking, lockdep: Convert sprintf_symbol to %pS

2010-11-10 10:23:58 +01:00

lockdep_states.h

…

lockdep.c

lockdep: Move early boot local IRQ enable/disable status to init/main.c

2011-01-20 13:32:33 +01:00

Makefile

kernel: clean up USE_GENERIC_SMP_HELPERS

2011-01-13 08:03:08 -08:00

module.c

printk: use %pK for /proc/kallsyms and /proc/modules

2011-03-22 17:44:12 -07:00

mutex-debug.c

…

mutex-debug.h

…

mutex.c

mutexes, sched: Introduce arch_mutex_cpu_relax()

2010-11-26 15:05:34 +01:00

mutex.h

…

notifier.c

…

ns_cgroup.c

cgroup: notify ns_cgroup deprecated

2010-10-27 18:03:09 -07:00

nsproxy.c

userns: user namespaces: convert several capable() calls

2011-03-23 19:47:08 -07:00

padata.c

Merge git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6

2010-08-04 15:23:14 -07:00

panic.c

move x86 specific oops=panic to generic code

2011-03-22 17:44:11 -07:00

params.c

module: show version information for built-in modules in sysfs

2011-01-24 14:32:51 +10:30

perf_event.c

perf: Fix tear-down of inherited group events

2011-03-16 14:04:14 +01:00

pid_namespace.c

pidns: call pid_ns_prepare_proc() from create_pid_namespace()

2011-03-23 19:46:58 -07:00

pid.c

export pid symbols needed for kvm_vcpu_on_spin

2011-03-17 13:08:28 -03:00

pm_qos_params.c

PM QoS: Make pm_qos settings readable

2011-03-15 00:43:18 +01:00

posix-cpu-timers.c

posix-timers: Cleanup namespace

2011-02-02 15:28:19 +01:00

posix-timers.c

timers: Export CLOCK_BOOTTIME via the posix timers interface

2011-02-21 12:53:09 -08:00

printk.c

printk: allow setting DEFAULT_MESSAGE_LEVEL via Kconfig

2011-03-22 17:44:13 -07:00

profile.c

llseek: automatically add .llseek fop

2010-10-15 15:53:27 +02:00

ptrace.c

userns: allow ptrace from non-init user namespaces

2011-03-23 19:47:05 -07:00

range.c

kernel/range.c: fix clean_sort_range() for the case of full array

2010-11-12 07:55:31 -08:00

rcupdate.c

rcu: add comment saying why DEBUG_OBJECTS_RCU_HEAD depends on PREEMPT.

2011-03-04 08:05:41 -08:00

rcutiny_plugin.h

rcu: call __rcu_read_unlock() in exit_rcu for tiny RCU

2011-03-04 08:05:08 -08:00

rcutiny.c

rcu: avoid pointless blocked-task warnings

2011-01-14 04:58:08 -08:00

rcutorture.c

rcutorture: Get rid of duplicate sched.h include

2011-03-04 08:05:17 -08:00

rcutree_plugin.h

rcu: increase synchronize_sched_expedited() batching

2010-12-17 12:34:08 -08:00

rcutree_trace.c

rcu,cleanup: simplify the code when cpu is dying

2010-11-29 22:01:58 -08:00

rcutree.c

Merge branch 'for-2.6.38' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/percpu

2011-01-07 17:02:58 -08:00

rcutree.h

rcu: limit rcu_node leaf-level fanout

2010-12-17 12:34:20 -08:00

relay.c

Clean up relay_alloc_page_array() slightly by using vzalloc rather than vmalloc and memset

2010-11-05 08:21:34 -07:00

res_counter.c

memcg: res_counter_read_u64(): fix potential races on 32-bit machines

2011-03-23 19:46:22 -07:00

resource.c

resources: add arch hook for preventing allocation in reserved areas

2010-12-17 10:01:09 -08:00

rtmutex_common.h

rtmutex: Simplify PI algorithm and make highest prio task get lock

2011-01-27 21:13:51 -05:00

rtmutex-debug.c

rtmutex: Simplify PI algorithm and make highest prio task get lock

2011-01-27 21:13:51 -05:00

rtmutex-debug.h

…

rtmutex-tester.c

rtmutex: tester: Remove the remaining BKL leftovers

2011-02-22 22:07:22 +01:00

rtmutex.c

rtmutex: Simplify PI algorithm and make highest prio task get lock

2011-01-27 21:13:51 -05:00

rtmutex.h

…

rwsem.c

…

sched_autogroup.c

sched, autogroup: Stop claiming ownership of the root task group

2011-02-23 11:34:03 +01:00

sched_autogroup.h

sched, autogroup: Stop going ahead if autogroup is disabled

2011-02-23 11:33:59 +01:00

sched_clock.c

sched: Add some clock info to sched_debug

2010-11-23 10:29:08 +01:00

sched_cpupri.c

sched: No need for bootmem special cases

2010-07-17 12:06:22 +02:00

sched_cpupri.h

sched: No need for bootmem special cases

2010-07-17 12:06:22 +02:00

sched_debug.c

sched: Use a buddy to implement yield_task_fair()

2011-02-03 14:20:33 +01:00

sched_fair.c

sched: Resched proper CPU on yield_to()

2011-03-04 11:14:31 +01:00

sched_features.h

sched: Rewrite tg_shares_up)

2010-11-18 13:27:46 +01:00

sched_idletask.c

sched: Fix switch_from_fair()

2011-01-26 12:33:22 +01:00

sched_rt.c

Merge branch 'sched/urgent' into sched/core

2011-03-04 11:12:26 +01:00

sched_stats.h

sched_stat: Update sched_info_queue/dequeue() code comments

2010-10-24 13:29:01 +02:00

sched_stoptask.c

sched: Fix switch_from_fair()

2011-01-26 12:33:22 +01:00

sched.c

userns: user namespaces: convert several capable() calls

2011-03-23 19:47:08 -07:00

seccomp.c

…

semaphore.c

…

signal.c

userns: allow killing tasks in your own or child userns

2011-03-23 19:47:04 -07:00

smp.c

smp: move smp setup functions to kernel/smp.c

2011-03-22 17:44:11 -07:00

softirq.c

kthread: use kthread_create_on_node()

2011-03-22 17:44:01 -07:00

spinlock.c

…

srcu.c

rcu: demote SRCU_SYNCHRONIZE_DELAY from kernel-parameter status

2011-01-14 04:56:49 -08:00

stacktrace.c

…

stop_machine.c

kthread: use kthread_create_on_node()

2011-03-22 17:44:01 -07:00

sys_ni.c

vfs: Add open by file handle support

2011-03-15 02:21:44 -04:00

sys.c

userns: user namespaces: convert all capable checks in kernel/sys.c

2011-03-23 19:47:06 -07:00

sysctl_binary.c

open-style analog of vfs_path_lookup()

2011-03-14 09:15:28 -04:00

sysctl_check.c

sysctl_check: drop dead code

2011-03-23 19:46:51 -07:00

sysctl.c

sysctl: restrict write access to dmesg_restrict

2011-03-23 19:46:54 -07:00

taskstats.c

taskstats: use better ifdef for alignment

2011-01-13 08:03:19 -08:00

test_kprobes.c

kprobes: Fix selftest to clear flags field for reusing probes

2010-10-14 08:55:27 +02:00

time.c

Merge branch 'timers-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip

2011-03-15 18:53:35 -07:00

timeconst.pl

…

timer.c

Merge branch 'timers-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip

2011-03-15 18:53:35 -07:00

tracepoint.c

tracepoints: Fix section alignment using pointer array

2011-02-03 09:28:46 -05:00

tsacct.c

taskstats: use real microsecond granularity for CPU times

2010-10-27 18:03:17 -07:00

uid16.c

userns: user namespaces: convert several capable() calls

2011-03-23 19:47:08 -07:00

up.c

…

user_namespace.c

user_ns: improve the user_ns on-the-slab packaging

2011-01-13 08:03:18 -08:00

user-return-notifier.c

…

user.c

userns: add a user_namespace as creator/owner of uts_namespace

2011-03-23 19:46:59 -07:00

utsname_sysctl.c

…

utsname.c

userns: allow sethostname in a container

2011-03-23 19:47:03 -07:00

wait.c

docbook: add more wait/wake/completion to device-drivers docbook

2010-10-26 17:32:41 -07:00

watchdog.c

kernel/watchdog.c: always return NOTIFY_OK during cpu up/down events

2011-03-22 17:44:12 -07:00

workqueue_sched.h

workqueue: implement concurrency managed dynamic worker pool

2010-06-29 10:07:14 +02:00

workqueue.c

kthread: use kthread_create_on_node()

2011-03-22 17:44:01 -07:00