[Devel] [PATCH rh7] net/scm/creds: drop redundant check for pid against init userns in scm_check_creds()

[Kirill Tkhai]

On 16.12.2017 02:49, Konstantin Khorenko wrote:
> Normally scm_check_creds() checks if received pid equals to "current" pid in
> current userns and our additional check for equality to "current" pid in init
> userns seems to be a leftover:
> 
> in 2.6.18-x we had the following patch:
>  static __inline__ int scm_check_creds(struct ucred *creds)
>  {
> -       if ((creds->pid == current->tgid || capable(CAP_SYS_ADMIN)) &&
> +       if ((creds->pid == virt_tgid(current) ||
> +            creds->pid == current->tgid ||
> +            capable(CAP_VE_SYS_ADMIN)) &&
> 
> while mainstream patch:
> 
> commit b488893a390edfe027bae7a46e9af8083e740668
> Author: Pavel Emelyanov <xemul at openvz.org>
> Date:   Thu Oct 18 23:40:14 2007 -0700
> 
>     pid namespaces: changes to show virtual ids to user
> 
>  static __inline__ int scm_check_creds(struct ucred *creds)
>  {
> -       if ((creds->pid == current->tgid || capable(CAP_SYS_ADMIN)) &&
> +       if ((creds->pid == task_tgid_vnr(current) || capable(CAP_SYS_ADMIN)) &&
> 
> Signed-off-by: Konstantin Khorenko <khorenko at virtuozzo.com>

Reviewed-by: Kirill Tkhai <ktkhai at virtuozzo.com>

> ---
>  net/core/scm.c | 1 -
>  1 file changed, 1 deletion(-)
> 
> diff --git a/net/core/scm.c b/net/core/scm.c
> index cecf199..23c7eab 100644
> --- a/net/core/scm.c
> +++ b/net/core/scm.c
> @@ -54,7 +54,6 @@ static __inline__ int scm_check_creds(struct ucred *creds)
>  		return -EINVAL;
>  
>  	if ((creds->pid == task_tgid_vnr(current) ||
> -	     creds->pid == current->tgid ||
>  	     ns_capable(task_active_pid_ns(current)->user_ns, CAP_SYS_ADMIN)) &&
>  	    ((uid_eq(uid, cred->uid)   || uid_eq(uid, cred->euid) ||
>  	      uid_eq(uid, cred->suid)) || ns_capable(cred->user_ns, CAP_SETUID)) &&
>