blob: ddabc71ed6f3d8732592b939a30c14e54d9537d6 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
|
diff --git a/kernel/seccomp.c b/kernel/seccomp.c
index 25f62867a16d..7b63ccc8daf4 100644
--- a/kernel/seccomp.c
+++ b/kernel/seccomp.c
@@ -2216,8 +2216,12 @@ long seccomp_get_filter(struct task_struct *task, unsigned long filter_off,
struct seccomp_filter *filter;
struct sock_fprog_kern *fprog;
long ret;
+ struct user_namespace *user_ns = current_user_ns();
- if (!capable(CAP_SYS_ADMIN) ||
+ if (in_userns(user_ns, task_cred_xxx(task, user_ns))) {
+ if (!ns_capable(user_ns, CAP_SYS_ADMIN))
+ return -EACCES;
+ } else if (!capable(CAP_SYS_ADMIN) ||
current->seccomp.mode != SECCOMP_MODE_DISABLED) {
return -EACCES;
}
|
