prctl: Use CAP_SYS_RESOURCE for PR_SET_MM option

PATCH New Cyrill Gorcunov 1 participant 1 message Mar 7, 2012

Share & tools

Cyrill Gorcunov

author

2012-03-07 21:22 UTC #0 lore raw

PATCH 1/1 prctl: Use CAP_SYS_RESOURCE for PR_SET_MM option

CAP_SYS_ADMIN is already overloaded left and right, so to have more fine-grained access control use CAP_SYS_RESOURCE here.

The CAP_SYS_RESOUCE is chosen because this prctl option allows a current process to adjust some fields of memory map descriptor which rather represents what the process owns: pointers to code, data, stack segments, command line, auxiliary vector data and etc.

Acked-by Kees Cook <[email protected]>

Acked-by Michael Kerrisk <[email protected]>

CC Andrew Morton <[email protected]>

CC Pavel Emelyanov <[email protected]>

CC Tejun Heo <[email protected]>

CC Oleg Nesterov <[email protected]>

CC Paul Bolle <[email protected]>

CC KOSAKI Motohiro <[email protected]>

Signed-off-by Cyrill Gorcunov <[email protected]>

---

Typo is fixed.

 kernel/sys.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

kernel/sys.c +1 -1

Index: linux-2.6.git/kernel/sys.c
===================================================================
@@ -1712,7 +1712,7 @@ static int prctl_set_mm(int opt, unsigne
 	if (arg5 || (arg4 && opt != PR_SET_MM_AUXV))
 		return -EINVAL;
 
-	if (!capable(CAP_SYS_ADMIN))
+	if (!capable(CAP_SYS_RESOURCE))
 		return -EPERM;
 
 	if (addr >= TASK_SIZE)