[PATCH 10/13] cgroup/v1: use cred_ids_allow_move()

Josef Bacik josef at toxicpanda.com
Sun Oct 18 17:31:52 UTC 2026


Use the library in __cgroup1_procs_write(). That euid 0 may move anybody
is part of the rule.

No functional change.

Assisted-by: LLM
Signed-off-by: Josef Bacik <josef at toxicpanda.com>
---
 kernel/cgroup/cgroup-v1.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/kernel/cgroup/cgroup-v1.c b/kernel/cgroup/cgroup-v1.c
index a4337c9b5287..c6b0f67b4817 100644
--- a/kernel/cgroup/cgroup-v1.c
+++ b/kernel/cgroup/cgroup-v1.c
@@ -521,9 +521,7 @@ static ssize_t __cgroup1_procs_write(struct kernfs_open_file *of,
 	 */
 	cred = of->file->f_cred;
 	tcred = get_task_cred(task);
-	if (!uid_eq(cred->euid, GLOBAL_ROOT_UID) &&
-	    !uid_eq(cred->euid, tcred->uid) &&
-	    !uid_eq(cred->euid, tcred->suid))
+	if (!cred_ids_allow_move(cred, tcred))
 		ret = -EACCES;
 	put_cred(tcred);
 	if (ret)

-- 
2.55.0




More information about the Linux-security-module-archive mailing list