From 18add6a9bdc4109deb88a14afc83bba1239d8865 Mon Sep 17 00:00:00 2001 From: NAKAMURA Gou Date: Mon, 28 Mar 2016 15:55:44 +0900 Subject: [PATCH] shmctl(IPC_RMID): fix wrong owner/creator checking (revised) Don't check owner/creator of the segment in case of superuser. --- kernel/syscall.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/kernel/syscall.c b/kernel/syscall.c index 15701cac..b90eeee6 100644 --- a/kernel/syscall.c +++ b/kernel/syscall.c @@ -51,6 +51,7 @@ #include #include #include +#include /* Headers taken from kitten LWK */ #include @@ -3785,7 +3786,8 @@ SYSCALL_DECLARE(shmctl) dkprintf("shmctl(%#x,%d,%p): lookup: %d\n", shmid, cmd, buf, error); return error; } - if ((obj->ds.shm_perm.uid != proc->euid) + if (!has_cap_sys_admin(thread) + && (obj->ds.shm_perm.uid != proc->euid) && (obj->ds.shm_perm.cuid != proc->euid)) { shmobj_list_unlock(); dkprintf("shmctl(%#x,%d,%p): -EPERM\n", shmid, cmd, buf);