[Devel] [PATCH 1/2] userns: Allow PR_CAPBSET_DROP in a user namespace.

[Andrew Vagin]

From: Eric W. Biederman <ebiederm at xmission.com>

As the capabilites and capability bounding set are per user namespace
properties it is safe to allow changing them with just CAP_SETPCAP
permission in the user namespace.

Acked-by: Serge Hallyn <serge.hallyn at canonical.com>
Tested-by: Richard Weinberger <richard at nod.at>
Signed-off-by: "Eric W. Biederman" <ebiederm at xmission.com>
Signed-off-by: Andrew Vagin <avagin at openvz.org>
---
 security/commoncap.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/security/commoncap.c b/security/commoncap.c
index 3d7811d..59ff538 100644
--- a/security/commoncap.c
+++ b/security/commoncap.c
@@ -852,7 +852,7 @@ static int cap_prctl_drop(unsigned long cap)
 {
 	struct cred *new;
 
-	if (!capable(CAP_SETPCAP))
+	if (!ns_capable(current_user_ns(), CAP_SETPCAP))
 		return -EPERM;
 	if (!cap_valid(cap))
 		return -EINVAL;
-- 
1.7.1