[RFC PATCH v1 4/6] proc: Allow to use the allowlist filter in userns
Alexey Gladkov <[email protected]> Wed, 25 Jan 2023 16:28:51 +0100
| Newsgroups | dev.linux.lists.containers,org.kernel.vger.linux-fsdevel,org.kernel.vger.linux-kernel |
|---|---|
| Message-ID | <76e8b2d0c0651af6906351b7d43fa2a4d117dc04.1674660533.git.legion@kernel.org> |
Signed-off-by: Alexey Gladkov <[email protected]> --- fs/proc/proc_allowlist.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/fs/proc/proc_allowlist.c b/fs/proc/proc_allowlist.c index 2153acb8e467..c605f73622bd 100644 --- a/fs/proc/proc_allowlist.c +++ b/fs/proc/proc_allowlist.c @@ -100,7 +100,7 @@ static int open_allowlist(struct inode *inode, struct file *file) struct proc_fs_info *fs_info = proc_sb_info(inode->i_sb); int ret; - if (!capable(CAP_SYS_ADMIN)) + if (!ns_capable(current_user_ns(), CAP_SYS_ADMIN)) return -EPERM; // we need this because shrink_dcache_sb() can't drop our own dentry. @@ -199,7 +199,7 @@ static const struct proc_ops proc_allowlist_ops = { static int __init proc_allowlist_init(void) { struct proc_dir_entry *pde; - pde = proc_create("allowlist", S_IRUSR | S_IWUSR, NULL, &proc_allowlist_ops); + pde = proc_create("allowlist", S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP | S_IROTH | S_IWOTH, NULL, &proc_allowlist_ops); pde_make_permanent(pde); pde_make_allowlist(pde); return 0; -- 2.33.6