diff options
authorLinus Torvalds <torvalds@linux-foundation.org>2021-08-31 12:16:05 -0700
committerLinus Torvalds <torvalds@linux-foundation.org>2021-08-31 12:16:05 -0700
commite55f0c439a2681a3c299bedd99ebe998049fa508 (patch)
parent67b03f93a30facabf105b8b8632e3b9b6ef9200a (diff)
parent2863643fb8b92291a7e97ba46e342f1163595fa8 (diff)
Merge tag 'kernel.sys.v5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/brauner/linux
Pull set_user() update from Christian Brauner: "This contains a single fix to set_user() which aligns permission checks with the corresponding fork() codepath. No one involved in this could come up with a reason for the difference. A capable caller can already circumvent the check when they fork where the permission checks are already for the relevant capabilities in addition to also allowing to exceed nproc when it is the init user. So apply the same logic to set_user()" * tag 'kernel.sys.v5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/brauner/linux: set_user: add capability check when rlimit(RLIMIT_NPROC) exceeds
1 files changed, 2 insertions, 1 deletions
diff --git a/kernel/sys.c b/kernel/sys.c
index ef1a78f5d71c..72c7639e3c98 100644
--- a/kernel/sys.c
+++ b/kernel/sys.c
@@ -480,7 +480,8 @@ static int set_user(struct cred *new)
* failure to the execve() stage.
if (is_ucounts_overlimit(new->ucounts, UCOUNT_RLIMIT_NPROC, rlimit(RLIMIT_NPROC)) &&
- new_user != INIT_USER)
+ new_user != INIT_USER &&
+ !capable(CAP_SYS_RESOURCE) && !capable(CAP_SYS_ADMIN))
current->flags |= PF_NPROC_EXCEEDED;
current->flags &= ~PF_NPROC_EXCEEDED;

Privacy Policy