)]}'
{
  "commit": "17f60a7da150fdd0cfb9756f86a262daa72c835f",
  "tree": "1c5ece75d66bed0766de861cde6eb18ee7ea4cf2",
  "parents": [
    "cfc64fd91fabed099a4c3df58559f4b7efe9bcce"
  ],
  "author": {
    "name": "Eric Paris",
    "email": "eparis@redhat.com",
    "time": "Fri Apr 01 17:07:50 2011 -0400"
  },
  "committer": {
    "name": "James Morris",
    "email": "jmorris@namei.org",
    "time": "Mon Apr 04 10:31:04 2011 +1000"
  },
  "message": "capabilites: allow the application of capability limits to usermode helpers\n\nThere is no way to limit the capabilities of usermodehelpers. This problem\nreared its head recently when someone complained that any user with\ncap_net_admin was able to load arbitrary kernel modules, even though the user\ndidn\u0027t have cap_sys_module.  The reason is because the actual load is done by\na usermode helper and those always have the full cap set.  This patch addes new\nsysctls which allow us to bound the permissions of usermode helpers.\n\n/proc/sys/kernel/usermodehelper/bset\n/proc/sys/kernel/usermodehelper/inheritable\n\nYou must have CAP_SYS_MODULE  and CAP_SETPCAP to change these (changes are\n\u0026\u003d ONLY).  When the kernel launches a usermodehelper it will do so with these\nas the bset and pI.\n\n-v2:\tmake globals static\n\tcreate spinlock to protect globals\n\n-v3:\trequire both CAP_SETPCAP and CAP_SYS_MODULE\n-v4:\tfix the typo s/CAP_SET_PCAP/CAP_SETPCAP/ because I didn\u0027t commit\nSigned-off-by: Eric Paris \u003ceparis@redhat.com\u003e\nNo-objection-from: Serge E. Hallyn \u003cserge.hallyn@canonical.com\u003e\nAcked-by: David Howells \u003cdhowells@redhat.com\u003e\nAcked-by: Serge E. Hallyn \u003cserge.hallyn@canonical.com\u003e\nAcked-by: Andrew G. Morgan \u003cmorgan@kernel.org\u003e\nSigned-off-by: James Morris \u003cjmorris@namei.org\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "6efd7a78de6aaaa6d74c526ba44f5fafa81e1fad",
      "old_mode": 33188,
      "old_path": "include/linux/kmod.h",
      "new_id": "79bb98d71858f3656dd4a880697384279e572c82",
      "new_mode": 33188,
      "new_path": "include/linux/kmod.h"
    },
    {
      "type": "modify",
      "old_id": "9cd0591c96a21acf825861c7672533c0273ae25e",
      "old_mode": 33188,
      "old_path": "kernel/kmod.c",
      "new_id": "06fdea2819b6f54e8296aa2e0aab0b6c00f527f2",
      "new_mode": 33188,
      "new_path": "kernel/kmod.c"
    },
    {
      "type": "modify",
      "old_id": "c0bb32414b174d575f836c9eb779f2e30cb793dd",
      "old_mode": 33188,
      "old_path": "kernel/sysctl.c",
      "new_id": "965134bed6cd8d39e4b279bc6bb713b65e59cfae",
      "new_mode": 33188,
      "new_path": "kernel/sysctl.c"
    }
  ]
}