commit 8cc698d951997aaed1888bfd1167c8d0e2849970
author John Stultz <john.stultz@linaro.org> Tue Oct 18 16:20:23 2016 -0700
committer Dmitry Shmidt <dimitrysh@google.com> Fri Jan 27 13:55:31 2017 -0800
tree eb41bb05ff89986c38d796448cac9996aee420d7
parent 579a63bf28cfddfaf51a18e816ac735fab2c2236

ANDROID: [RFC]cgroup: Change from CAP_SYS_NICE to CAP_SYS_RESOURCE for cgroup migration permissions

Try to better match what we're pushing upstream, use CAP_SYS_RESOURCE
instead of CAP_SYS_NICE, which shoudln't affect Android as Zygote and
system_server already use CAP_SYS_RESOURCE.

Change-Id: I9b7ba2d9be1a469c9636497a6287f840891a91a8
Signed-off-by: John Stultz <john.stultz@linaro.org>

kernel/cgroup.c

diff --git a/kernel/cgroup.c b/kernel/cgroup.c
index c014c9b..866059a 100644
--- a/kernel/cgroup.c
+++ b/kernel/cgroup.c
@@ -2857,7 +2857,7 @@
 	if (!uid_eq(cred->euid, GLOBAL_ROOT_UID) &&
 	    !uid_eq(cred->euid, tcred->uid) &&
 	    !uid_eq(cred->euid, tcred->suid) &&
-	    !ns_capable(tcred->user_ns, CAP_SYS_NICE))
+	    !ns_capable(tcred->user_ns, CAP_SYS_RESOURCE))
 		ret = -EACCES;
 
 	if (!ret && cgroup_on_dfl(dst_cgrp)) {