[Devel] [PATCH hci-8.1 1/2] capability: Add new helper to check specific VE capabilities

[Vladimir Riabchun <vladimir.riabchun@virtuozzo.com>]

Currently ve_capable checks only current VE caps. It is useful to be
able to check capabilities of VEs other than current.

https://virtuozzo.atlassian.net/browse/VSTOR-142405
Signed-off-by: Vladimir Riabchun <vladimir.riabchun@virtuozzo.com>
---
 include/linux/capability.h |  3 +++
 kernel/capability.c        | 15 +++++++++++++--
 2 files changed, 16 insertions(+), 2 deletions(-)

diff --git a/include/linux/capability.h b/include/linux/capability.h
index e1cc7133b16c..443fc2331cac 100644
--- a/include/linux/capability.h
+++ b/include/linux/capability.h
@@ -191,6 +191,9 @@ bool privileged_wrt_inode_uidgid(struct user_namespace *ns,
 				 const struct inode *inode);
 bool capable_wrt_inode_uidgid(struct mnt_idmap *idmap,
 			      const struct inode *inode, int cap);
+
+struct ve_struct;
+extern bool __ve_capable(struct ve_struct *ve, int cap);
 extern bool ve_capable(int cap);
 extern bool feature_capable(int feature, int cap);
 extern bool file_ns_capable(const struct file *file, struct user_namespace *ns, int cap);
diff --git a/kernel/capability.c b/kernel/capability.c
index 34716847c6b8..1dd88645a6a3 100644
--- a/kernel/capability.c
+++ b/kernel/capability.c
@@ -386,13 +386,13 @@ bool ns_capable(struct user_namespace *ns, int cap)
 EXPORT_SYMBOL(ns_capable);
 
 #ifdef CONFIG_VE
-bool ve_capable(int cap)
+bool __ve_capable(struct ve_struct *ve, int cap)
 {
 	struct cred *cred;
 	bool ret;
 
 	rcu_read_lock();
-	cred = get_exec_env()->init_cred;
+	cred = ve->init_cred;
 
 	if (cred == NULL) /* ve isn't running */
 		cred = ve0.init_cred;
@@ -403,6 +403,11 @@ bool ve_capable(int cap)
 	return ret;
 }
 
+bool ve_capable(int cap)
+{
+	return __ve_capable(get_exec_env(), cap);
+}
+
 bool ve_capable_noaudit(int cap)
 {
 	struct cred *cred;
@@ -428,6 +433,11 @@ bool feature_capable(int feature, int cap)
 		return capable(cap);
 }
 #else
+bool __ve_capable(struct ve_struct *ve, int cap)
+{
+	return capable(cap);
+}
+
 bool ve_capable(int cap)
 {
 	return capable(cap);
@@ -443,6 +453,7 @@ bool feature_capable(int feature, int cap)
 	return capable(cap);
 }
 #endif
+EXPORT_SYMBOL_GPL(__ve_capable);
 EXPORT_SYMBOL_GPL(ve_capable);
 EXPORT_SYMBOL_GPL(ve_capable_noaudit);
 

-- 
2.47.1

_______________________________________________
Devel mailing list
Devel@openvz.org
https://lists.openvz.org/mailman/listinfo/devel