diff options
| author | Dmitry Torokhov <dmitry.torokhov@gmail.com> | 2016-08-10 14:36:02 -0700 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2016-08-14 21:08:58 -0700 |
| commit | e79c6a4fc923eed2bdd3b716e0f01414847db90a (patch) | |
| tree | ad2cc7b3534b8767f507caf65b093fe4fca43fa9 /fs/proc | |
| parent | c110486f6cb240f36ec143cad6628d52c071f529 (diff) | |
net: make net namespace sysctls belong to container's owner
If net namespace is attached to a user namespace let's make container's
root owner of sysctls affecting said network namespace instead of global
root.
This also allows us to clean up net_ctl_permissions() because we do not
need to fudge permissions anymore for the container's owner since it now
owns the objects in question.
Acked-by: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'fs/proc')
| -rw-r--r-- | fs/proc/proc_sysctl.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/fs/proc/proc_sysctl.c b/fs/proc/proc_sysctl.c index b59db94d2ff4..62d8c6975d34 100644 --- a/fs/proc/proc_sysctl.c +++ b/fs/proc/proc_sysctl.c @@ -430,6 +430,7 @@ static int sysctl_perm(struct ctl_table_header *head, struct ctl_table *table, i static struct inode *proc_sys_make_inode(struct super_block *sb, struct ctl_table_header *head, struct ctl_table *table) { + struct ctl_table_root *root = head->root; struct inode *inode; struct proc_inode *ei; @@ -457,6 +458,10 @@ static struct inode *proc_sys_make_inode(struct super_block *sb, if (is_empty_dir(head)) make_empty_dir_inode(inode); } + + if (root->set_ownership) + root->set_ownership(head, table, &inode->i_uid, &inode->i_gid); + out: return inode; } |