Re: [RESEND PATCH] Allow passing tid or pid in SCM_CREDENTIALS without CAP_SYS_ADMIN

2017-09-01 Thread Eric W. Biederman
Prakash Sangappa writes: > On 8/30/17 10:41 AM, ebied...@xmission.com wrote: >> Prakash Sangappa writes: >> >> >>> With regards to security, the question basically is what is the consequence >>> of passing the wrong id. As I understand it, Interpreting the id to be pid >>> or tid, the effective

Re: [RESEND PATCH] Allow passing tid or pid in SCM_CREDENTIALS without CAP_SYS_ADMIN

2017-09-01 Thread Prakash Sangappa
On 8/30/17 10:41 AM, ebied...@xmission.com wrote: Prakash Sangappa writes: With regards to security, the question basically is what is the consequence of passing the wrong id. As I understand it, Interpreting the id to be pid or tid, the effective uid and gid will be the same. It would be a

Re: [RESEND PATCH] Allow passing tid or pid in SCM_CREDENTIALS without CAP_SYS_ADMIN

2017-08-30 Thread Eric W. Biederman
Prakash Sangappa writes: > On 8/29/17 5:10 PM, ebied...@xmission.com wrote: > > "prakash.sangappa" writes: > > On 08/29/2017 04:02 PM, David Miller wrote: > > From: Prakash Sangappa > Date: Mon, 28 Aug 2017 17:12:20 -0700 > > Currently passing tid(gettid(2)) of a thread in struct ucred in >

Re: [RESEND PATCH] Allow passing tid or pid in SCM_CREDENTIALS without CAP_SYS_ADMIN

2017-08-29 Thread Eric W. Biederman
"prakash.sangappa" writes: > On 08/29/2017 04:02 PM, David Miller wrote: >> From: Prakash Sangappa >> Date: Mon, 28 Aug 2017 17:12:20 -0700 >> >>> Currently passing tid(gettid(2)) of a thread in struct ucred in >>> SCM_CREDENTIALS message requires CAP_SYS_ADMIN capability otherwise >>> it fails

Re: [RESEND PATCH] Allow passing tid or pid in SCM_CREDENTIALS without CAP_SYS_ADMIN

2017-08-29 Thread prakash.sangappa
On 08/29/2017 04:02 PM, David Miller wrote: From: Prakash Sangappa Date: Mon, 28 Aug 2017 17:12:20 -0700 Currently passing tid(gettid(2)) of a thread in struct ucred in SCM_CREDENTIALS message requires CAP_SYS_ADMIN capability otherwise it fails with EPERM error. Some applications deal with

Re: [RESEND PATCH] Allow passing tid or pid in SCM_CREDENTIALS without CAP_SYS_ADMIN

2017-08-29 Thread David Miller
From: Prakash Sangappa Date: Mon, 28 Aug 2017 17:12:20 -0700 > Currently passing tid(gettid(2)) of a thread in struct ucred in > SCM_CREDENTIALS message requires CAP_SYS_ADMIN capability otherwise > it fails with EPERM error. Some applications deal with thread id > of a thread(tid) and so it woul

[RESEND PATCH] Allow passing tid or pid in SCM_CREDENTIALS without CAP_SYS_ADMIN

2017-08-28 Thread Prakash Sangappa
Currently passing tid(gettid(2)) of a thread in struct ucred in SCM_CREDENTIALS message requires CAP_SYS_ADMIN capability otherwise it fails with EPERM error. Some applications deal with thread id of a thread(tid) and so it would help to allow tid in SCM_CREDENTIALS message. Basically, either tgid(