diff options
| author | Eric W. Biederman <ebiederm@xmission.com> | 2014-12-05 17:19:27 -0600 |
|---|---|---|
| committer | Jiri Slaby <jslaby@suse.cz> | 2015-01-07 17:55:10 +0100 |
| commit | 281cac74a213639fa7a4d1b60553d011a4a11d6f (patch) | |
| tree | 0263df93413b1aae3646e3d2bb2df005c572b7bd /arch | |
| parent | e3783a9e6f416ee140ac4ca7184f269c537593f1 (diff) | |
groups: Consolidate the setgroups permission checks
commit 7ff4d90b4c24a03666f296c3d4878cd39001e81e upstream.
Today there are 3 instances of setgroups and due to an oversight their
permission checking has diverged. Add a common function so that
they may all share the same permission checking code.
This corrects the current oversight in the current permission checks
and adds a helper to avoid this in the future.
A user namespace security fix will update this new helper, shortly.
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Diffstat (limited to 'arch')
| -rw-r--r-- | arch/s390/kernel/compat_linux.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/arch/s390/kernel/compat_linux.c b/arch/s390/kernel/compat_linux.c index 1f1b8c70ab97..0ebb699aad1e 100644 --- a/arch/s390/kernel/compat_linux.c +++ b/arch/s390/kernel/compat_linux.c @@ -249,7 +249,7 @@ asmlinkage long sys32_setgroups16(int gidsetsize, u16 __user *grouplist) struct group_info *group_info; int retval; - if (!capable(CAP_SETGID)) + if (!may_setgroups()) return -EPERM; if ((unsigned)gidsetsize > NGROUPS_MAX) return -EINVAL; |