[Devel] [PATCH RH9 14/28] commoncap: relax setxattr and removxattr checks

[Andrey Zhadchenko]

Allow user to set security xattr (XATTR_SECURITY_PREFIX) from the inside
of ve on external mounts (for example, root).

https://jira.sw.ru/browse/PSBM-122071
Signed-off-by: Andrey Zhadchenko <andrey.zhadchenko at virtuozzo.com>

Cherry-picked from vz7 commit d92402f6a7c9 ("commoncap: relax setxattr and
removxattr checks")

Signed-off-by: Valeriy Vdovin <valeriy.vdovin at virtuozzo.com>

(cherry picked from vz8 commit 22dfe21e51e1bca0d420df7abc8e1a1eb0491a0d)
Signed-off-by: Andrey Zhadchenko <andrey.zhadchenko at virtuozzo.com>
---
 security/commoncap.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/security/commoncap.c b/security/commoncap.c
index 3f810d3..ae3799a 100644
--- a/security/commoncap.c
+++ b/security/commoncap.c
@@ -1007,7 +1007,8 @@ int cap_inode_setxattr(struct dentry *dentry, const char *name,
 		return 0;
 
 	if (!ns_capable(user_ns, CAP_SYS_ADMIN))
-		return -EPERM;
+		if (!ve_capable(CAP_SYS_ADMIN))
+			return -EPERM;
 	return 0;
 }
 
@@ -1051,7 +1052,8 @@ int cap_inode_removexattr(struct user_namespace *mnt_userns,
 	}
 
 	if (!ns_capable(user_ns, CAP_SYS_ADMIN))
-		return -EPERM;
+		if (!ve_capable(CAP_SYS_ADMIN))
+			return -EPERM;
 	return 0;
 }
 
-- 
1.8.3.1