From: Konstantin Khorenko <khore...@virtuozzo.com> Containers might have special features which affect capabilities, so here is a wrapper for code simplicity.
https://jira.sw.ru/browse/PSBM-94635 Signed-off-by: Konstantin Khorenko <khore...@virtuozzo.com> https://jira.sw.ru/browse/PSBM-127846 (cherry-picked from vz7 commit b64e08cf6ea0 ("ve/capability: introduce capable() wrapper which honors CT features")) Signed-off-by: Pavel Tikhomirov <ptikhomi...@virtuozzo.com> (cherry picked from vz8 commit 0c6787703b466480564e5b841c1a28c35f376218) Signed-off-by: Andrey Zhadchenko <andrey.zhadche...@virtuozzo.com> --- include/linux/capability.h | 1 + kernel/capability.c | 12 ++++++++++++ 2 files changed, 13 insertions(+) diff --git a/include/linux/capability.h b/include/linux/capability.h index 7761f5c..3986e57 100644 --- a/include/linux/capability.h +++ b/include/linux/capability.h @@ -254,6 +254,7 @@ bool privileged_wrt_inode_uidgid(struct user_namespace *ns, bool capable_wrt_inode_uidgid(struct user_namespace *mnt_userns, const struct inode *inode, int cap); extern bool ve_capable(int cap); +extern bool feature_capable(int feature, int cap); extern bool file_ns_capable(const struct file *file, struct user_namespace *ns, int cap); extern bool ptracer_capable(struct task_struct *tsk, struct user_namespace *ns); static inline bool perfmon_capable(void) diff --git a/kernel/capability.c b/kernel/capability.c index 318ffb8..ac990f4 100644 --- a/kernel/capability.c +++ b/kernel/capability.c @@ -433,6 +433,13 @@ bool ve_capable_noaudit(int cap) return ret; } +bool feature_capable(int feature, int cap) +{ + if (get_exec_env()->features & feature) + return ve_capable(cap); + else + return capable(cap); +} #else bool ve_capable(int cap) { @@ -443,6 +450,11 @@ bool ve_capable_noaudit(int cap) { return ns_capable_noaudit(&init_user_ns, cap); } + +bool feature_capable(int feature, int cap) +{ + return capable(cap); +} #endif EXPORT_SYMBOL_GPL(ve_capable); EXPORT_SYMBOL_GPL(ve_capable_noaudit); -- 1.8.3.1 _______________________________________________ Devel mailing list Devel@openvz.org https://lists.openvz.org/mailman/listinfo/devel
