pipe: change the privilege required for growing a pipe beyond system max

Change it to CAP_SYS_RESOURCE, as that more accurately models what
we want to control.

Suggested-by: Michael Kerrisk <mtk.manpages@googlemail.com>
Signed-off-by: Jens Axboe <jaxboe@fusionio.com>

diff --git a/fs/pipe.c b/fs/pipe.c
index 369a0245aab65e826a15e7a8e08f287a8a47183d..f98fae3e36b098a40be327174f95d0565d1f6c6e 100644 (file)
--- a/fs/pipe.c
+++ b/fs/pipe.c
@@ -1178,7 +1178,7 @@ long pipe_fcntl(struct file *file, unsigned int cmd, unsigned long arg)
                nr_pages = (arg + PAGE_SIZE - 1) >> PAGE_SHIFT;
                nr_pages = roundup_pow_of_two(nr_pages);
 
-               if (!capable(CAP_SYS_ADMIN) && nr_pages > pipe_max_pages) {
+               if (!capable(CAP_SYS_RESOURCE) && nr_pages > pipe_max_pages) {
                        ret = -EPERM;
                        goto out;
                } else if (nr_pages < 1) {