• Mickaël Salaün's avatar
    ptrace: Set PF_SUPERPRIV when checking capability · cf237052
    Mickaël Salaün authored
    Commit 69f594a3 ("ptrace: do not audit capability check when outputing
    /proc/pid/stat") replaced the use of ns_capable() with
    has_ns_capability{,_noaudit}() which doesn't set PF_SUPERPRIV.
    
    Commit 6b3ad664 ("ptrace: reintroduce usage of subjective credentials in
    ptrace_has_cap()") replaced has_ns_capability{,_noaudit}() with
    security_capable(), which doesn't set PF_SUPERPRIV neither.
    
    Since commit 98f368e9 ("kernel: Add noaudit variant of ns_capable()"), a
    new ns_capable_noaudit() helper is available.  Let's use it!
    
    As a result, the signature of ptrace_has_cap() is restored to its original one.
    
    Cc: Christian Brauner <christian.brauner@ubuntu.com>
    Cc: Eric Paris <eparis@redhat.com>
    Cc: Jann Horn <jannh@google.com>
    Cc: Kees Cook <keescook@chromium.org>
    Cc: Oleg Nesterov <oleg@redhat.com>
    Cc: Serge E. Hallyn <serge@hallyn.com>
    Cc: Tyler Hicks <tyhicks@linux.microsoft.com>
    Cc: stable@vger.kernel.org
    Fixes: 6b3ad664 ("ptrace: reintroduce usage of subjective credentials in ptrace_has_cap()")
    Fixes: 69f594a3
    
     ("ptrace: do not audit capability check when outputing /proc/pid/stat")
    Signed-off-by: default avatarMickaël Salaün <mic@linux.microsoft.com>
    Reviewed-by: default avatarJann Horn <jannh@google.com>
    Signed-off-by: default avatarKees Cook <keescook@chromium.org>
    Link: https://lore.kernel.org/r/20201030123849.770769-2-mic@digikod.net
    cf237052