Make TASKSTATS require root access

Ok, this isn't optimal, since it means that 'iotop' needs admin capabilities, and we may have to work on this some more. But at the same time it is very much not acceptable to let anybody just read anybody elses IO statistics quite at this level. Use of the GENL_ADMIN_PERM suggested by Johannes Berg as an alternative to checking the capabilities by hand. Reported-by: Vasiliy Kulikov <segoon@openwall.com> Cc: Johannes Berg <johannes.berg@intel.com> Acked-by: Balbir Singh <bsingharora@gmail.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Make TASKSTATS require root access
Ok, this isn't optimal, since it means that 'iotop' needs admin capabilities, and we may have to work on this some more. But at the same time it is very much not acceptable to let anybody just read anybody elses IO statistics quite at this level. Use of the GENL_ADMIN_PERM suggested by Johannes Berg as an alternative to checking the capabilities by hand. Reported-by: Vasiliy Kulikov <segoon@openwall.com> Cc: Johannes Berg <johannes.berg@intel.com> Acked-by: Balbir Singh <bsingharora@gmail.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Linus Torvalds
1 parent b6a68a5ba4
Showing 1 changed file with 1 additions and 0 deletions Side-by-side Diff
kernel/taskstats.c
@@ -655,6 +655,7 @@
 	.cmd		= TASKSTATS_CMD_GET,
 	.doit		= taskstats_user_cmd,
 	.policy		= taskstats_cmd_get_policy,
+	.flags		= GENL_ADMIN_PERM,
 };
  
 static struct genl_ops cgroupstats_ops = {
...	...	@@ -655,6 +655,7 @@
655	655	.cmd = TASKSTATS_CMD_GET,
656	656	.doit = taskstats_user_cmd,
657	657	.policy = taskstats_cmd_get_policy,
	658	+ .flags = GENL_ADMIN_PERM,
658	659	};
659	660
660	661	static struct genl_ops cgroupstats_ops = {