The problem is missing '!' in the capapability check line (same as with
arch/*/ptrace.c). cap_issubset(t->cap_permitted, current->cap_permitted)
returns 1 if current's capabilities are greater or equal to t's
capabilities.
ac1, kernel/signal.c:
&& (current->uid ^ t->suid) && (current->uid ^ t->uid)
&& (cap_issubset(t->cap_permitted, current->cap_permitted))
&& !capable(CAP_SYS_ADMIN))
Simple fix would look like:
&& !(cap_issubset(t->cap_permitted, current->cap_permitted))
I'd like to hear comments about whether CAP_SYS_PTRACE should override the
capability comparison in arch/*/ptrace.c (in the above case it seems
justified). Of course, that capability shouldn't be needed in a production
system :).
-Topi
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/