From 8b5b075f4c56e8a2deeea714be73017cdabb3393 Mon Sep 17 00:00:00 2001 From: NAKAMURA Gou Date: Thu, 10 Mar 2016 20:26:48 +0900 Subject: [PATCH] shmctl(IPC_RMID): fix wrong owner/creator checking Don't check owner/creator of the segment in case of superuser. --- kernel/syscall.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/kernel/syscall.c b/kernel/syscall.c index d6aeee17..d95a5e90 100644 --- a/kernel/syscall.c +++ b/kernel/syscall.c @@ -51,6 +51,7 @@ #include #include #include +#include /* Headers taken from kitten LWK */ #include @@ -3816,7 +3817,8 @@ SYSCALL_DECLARE(shmctl) dkprintf("shmctl(%#x,%d,%p): lookup: %d\n", shmid, cmd, buf, error); return error; } - if ((obj->ds.shm_perm.uid != proc->euid) + if (!has_cap_sys_admin(thread) + && (obj->ds.shm_perm.uid != proc->euid) && (obj->ds.shm_perm.cuid != proc->euid)) { shmobj_list_unlock(); dkprintf("shmctl(%#x,%d,%p): -EPERM\n", shmid, cmd, buf);