drivers/connector/connector.c

176

if (ns_capable(net->user_ns, CAP_NET_ADMIN))

drivers/infiniband/core/device.c

173

return ns_capable(net->user_ns, CAP_NET_RAW);

drivers/net/bonding/bond_main.c

4629

if (!ns_capable(net->user_ns, CAP_NET_ADMIN))

drivers/net/ipvlan/ipvlan_main.c

455

if (!ns_capable(dev_net(ipvlan->phy_dev)->user_ns, CAP_NET_ADMIN))

drivers/net/ipvlan/ipvlan_main.c

561

if (!ns_capable(dev_net(phy_dev)->user_ns, CAP_NET_ADMIN))

drivers/net/ppp/ppp_generic.c

1056

if (!ns_capable(net->user_ns, CAP_NET_ADMIN))

drivers/net/ppp/ppp_generic.c

399

if (!ns_capable(file->f_cred->user_ns, CAP_NET_ADMIN))

drivers/net/tun.c

2827

if (!ns_capable(net->user_ns, CAP_NET_ADMIN))

drivers/net/tun.c

3143

if (!ns_capable(net->user_ns, CAP_NET_ADMIN))

drivers/net/tun.c

3384

if (!ns_capable(net->user_ns, CAP_NET_ADMIN))

drivers/net/tun.c

522

!ns_capable(net->user_ns, CAP_NET_ADMIN);

drivers/net/wireguard/netlink.c

494

ret = !net || !ns_capable(net->user_ns, CAP_NET_ADMIN) ? -EPERM : 0;

fs/attr.c

104

ns_capable(inode->i_sb->s_user_ns, CAP_CHOWN))

fs/attr.c

135

ns_capable(inode->i_sb->s_user_ns, CAP_CHOWN))

fs/fhandle.c

298

return mnt_ns && ns_capable(mnt_ns->user_ns, CAP_SYS_ADMIN);

fs/fhandle.c

333

if (ns_capable(root->mnt->mnt_sb->s_user_ns, CAP_SYS_ADMIN))

fs/fhandle.c

343

if (!ns_capable(current_user_ns(), CAP_DAC_READ_SEARCH))

fs/fsopen.c

262

if (!ns_capable(sb->s_user_ns, CAP_SYS_ADMIN)) {

fs/init.c

88

if (!ns_capable(current_user_ns(), CAP_SYS_CHROOT))

fs/inode.c

2764

if (vfsuid_has_mapping(ns, vfsuid) && ns_capable(ns, CAP_FOWNER))

fs/ioctl.c

389

if (!ns_capable(sb->s_user_ns, CAP_SYS_ADMIN))

fs/ioctl.c

406

if (!ns_capable(sb->s_user_ns, CAP_SYS_ADMIN))

fs/namei.c

2752

!ns_capable(fd_file(f)->f_cred->user_ns, CAP_DAC_READ_SEARCH))

fs/namespace.c

1933

if (!ns_capable(sb->s_user_ns, CAP_SYS_ADMIN))

fs/namespace.c

2009

return ns_capable(current->nsproxy->mnt_ns->user_ns, CAP_SYS_ADMIN);

fs/namespace.c

2034

if (flags & MNT_FORCE && !ns_capable(sb->s_user_ns, CAP_SYS_ADMIN))

fs/namespace.c

2401

if (!ns_capable(old_mnt->mnt_ns->user_ns, CAP_SYS_ADMIN))

fs/namespace.c

2856

if (!ns_capable(ns->user_ns, CAP_SYS_ADMIN))

fs/namespace.c

3225

!ns_capable(current_user_ns(), CAP_SYS_ADMIN))

fs/namespace.c

3406

if (ns_capable(sb->s_user_ns, CAP_SYS_ADMIN)) {

fs/namespace.c

4450

!ns_capable(current_user_ns(), CAP_SYS_ADMIN))

fs/namespace.c

4830

if (!ns_capable(fs_userns, CAP_SYS_ADMIN))

fs/namespace.c

5041

if (!ns_capable(mnt_userns, CAP_SYS_ADMIN))

fs/namespace.c

6488

if (!ns_capable(mnt_ns->user_ns, CAP_SYS_ADMIN) ||

fs/namespace.c

6489

!ns_capable(user_ns, CAP_SYS_CHROOT) ||

fs/namespace.c

6490

!ns_capable(user_ns, CAP_SYS_ADMIN))

fs/notify/fanotify/fanotify_user.c

1962

!ns_capable(group->user_ns, CAP_SYS_ADMIN))

fs/notify/fanotify/fanotify_user.c

2074

if (user_ns && !ns_capable(user_ns, CAP_SYS_ADMIN))

fs/open.c

604

if (!ns_capable(current_user_ns(), CAP_SYS_CHROOT))

fs/proc/base.c

2585

if (!ns_capable(__task_cred(p)->user_ns, CAP_SYS_NICE)) {

fs/proc/base.c

2625

if (!ns_capable(__task_cred(p)->user_ns, CAP_SYS_NICE)) {

fs/proc/base.c

3165

if (!ns_capable(ns, CAP_SYS_ADMIN))

fs/proc/root.c

154

if (!ns_capable(target->user_ns, CAP_SYS_ADMIN)) {

fs/super.c

700

return ns_capable(fc->user_ns, CAP_SYS_ADMIN);

include/linux/capability.h

148

extern bool ns_capable(struct user_namespace *ns, int cap);

include/linux/capability.h

202

return ns_capable(ns, CAP_CHECKPOINT_RESTORE) ||

include/linux/capability.h

203

ns_capable(ns, CAP_SYS_ADMIN);

ipc/namespace.c

237

if (!ns_capable(ns->user_ns, CAP_SYS_ADMIN) ||

ipc/namespace.c

238

!ns_capable(nsset->cred->user_ns, CAP_SYS_ADMIN))

ipc/shm.c

1194

if (!ns_capable(ns->user_ns, CAP_IPC_LOCK)) {

ipc/util.c

568

!ns_capable(ns->user_ns, CAP_IPC_OWNER))

ipc/util.c

740

ns_capable(ns->user_ns, CAP_SYS_ADMIN))

kernel/bpf/token.c

14

return ns_capable(ns, cap) || (cap != CAP_SYS_ADMIN && ns_capable(ns, CAP_SYS_ADMIN));

kernel/bpf/token.c

146

if (!ns_capable(userns, CAP_BPF))

kernel/capability.c

365

EXPORT_SYMBOL(ns_capable);

kernel/capability.c

416

return ns_capable(&init_user_ns, cap);

kernel/capability.c

478

return ns_capable(ns, cap) &&

kernel/cgroup/cgroup-v1.c

1262

if (!ns_capable(ctx->ns->user_ns, CAP_SYS_ADMIN))

kernel/cgroup/namespace.c

64

if (!ns_capable(user_ns, CAP_SYS_ADMIN))

kernel/cgroup/namespace.c

97

if (!ns_capable(nsset->cred->user_ns, CAP_SYS_ADMIN) ||

kernel/cgroup/namespace.c

98

!ns_capable(cgroup_ns->user_ns, CAP_SYS_ADMIN))

kernel/events/core.c

13855

is_capable &= ns_capable(__task_cred(task)->user_ns, CAP_KILL);

kernel/fork.c

2092

!ns_capable(current_user_ns(), CAP_SYS_ADMIN))

kernel/nsproxy.c

181

} else if (!ns_capable(user_ns, CAP_SYS_ADMIN))

kernel/nsproxy.c

222

if (!ns_capable(user_ns, CAP_SYS_ADMIN))

kernel/pid_namespace.c

398

if (!ns_capable(new->user_ns, CAP_SYS_ADMIN) ||

kernel/pid_namespace.c

399

!ns_capable(nsset->cred->user_ns, CAP_SYS_ADMIN))

kernel/pid_sysctl.h

15

if (write && !ns_capable(ns->user_ns, CAP_SYS_ADMIN))

kernel/ptrace.c

290

return ns_capable(ns, CAP_SYS_PTRACE);

kernel/reboot.c

736

if (!ns_capable(pid_ns->user_ns, CAP_SYS_BOOT))

kernel/sched/syscalls.c

1212

if (!ns_capable(__task_cred(p)->user_ns, CAP_SYS_NICE))

kernel/signal.c

792

ns_capable(tcred->user_ns, CAP_KILL);

kernel/sys.c

1424

if (!ns_capable(current->nsproxy->uts_ns->user_ns, CAP_SYS_ADMIN))

kernel/sys.c

1478

if (!ns_capable(current->nsproxy->uts_ns->user_ns, CAP_SYS_ADMIN))

kernel/sys.c

1723

if (!id_match && !ns_capable(tcred->user_ns, CAP_SYS_RESOURCE))

kernel/sys.c

226

if (ns_capable(pcred->user_ns, CAP_SYS_NICE))

kernel/time/namespace.c

199

if (!ns_capable(ns->user_ns, CAP_SYS_ADMIN) ||

kernel/time/namespace.c

200

!ns_capable(nsset->cred->user_ns, CAP_SYS_ADMIN))

kernel/user_namespace.c

1207

if (ns_capable(ns->parent, cap_setid) &&

kernel/user_namespace.c

1361

if (!ns_capable(user_ns, CAP_SYS_ADMIN))

kernel/utsname.c

132

if (!ns_capable(ns->user_ns, CAP_SYS_ADMIN) ||

kernel/utsname.c

133

!ns_capable(nsset->cred->user_ns, CAP_SYS_ADMIN))

net/8021q/vlan.c

542

if (!ns_capable(net->user_ns, CAP_NET_ADMIN))

net/8021q/vlan.c

552

if (!ns_capable(net->user_ns, CAP_NET_ADMIN))

net/8021q/vlan.c

561

if (!ns_capable(net->user_ns, CAP_NET_ADMIN))

net/8021q/vlan.c

570

if (!ns_capable(net->user_ns, CAP_NET_ADMIN))

net/8021q/vlan.c

585

if (!ns_capable(net->user_ns, CAP_NET_ADMIN))

net/8021q/vlan.c

592

if (!ns_capable(net->user_ns, CAP_NET_ADMIN))

net/bridge/br_ioctl.c

219

if (!ns_capable(dev_net(dev)->user_ns, CAP_NET_ADMIN))

net/bridge/br_ioctl.c

226

if (!ns_capable(dev_net(dev)->user_ns, CAP_NET_ADMIN))

net/bridge/br_ioctl.c

233

if (!ns_capable(dev_net(dev)->user_ns, CAP_NET_ADMIN))

net/bridge/br_ioctl.c

240

if (!ns_capable(dev_net(dev)->user_ns, CAP_NET_ADMIN))

net/bridge/br_ioctl.c

280

if (!ns_capable(dev_net(dev)->user_ns, CAP_NET_ADMIN))

net/bridge/br_ioctl.c

287

if (!ns_capable(dev_net(dev)->user_ns, CAP_NET_ADMIN))

net/bridge/br_ioctl.c

296

if (!ns_capable(dev_net(dev)->user_ns, CAP_NET_ADMIN))

net/bridge/br_ioctl.c

310

if (!ns_capable(dev_net(dev)->user_ns, CAP_NET_ADMIN))

net/bridge/br_ioctl.c

379

if (!ns_capable(net->user_ns, CAP_NET_ADMIN))

net/bridge/br_ioctl.c

406

if (!ns_capable(net->user_ns, CAP_NET_ADMIN))

net/bridge/br_ioctl.c

430

if (!ns_capable(net->user_ns, CAP_NET_ADMIN)) {

net/bridge/br_ioctl.c

91

if (!ns_capable(net->user_ns, CAP_NET_ADMIN))

net/bridge/br_sysfs_br.c

313

if (!ns_capable(dev_net(br->dev)->user_ns, CAP_NET_ADMIN))

net/bridge/br_sysfs_br.c

42

if (!ns_capable(dev_net(br->dev)->user_ns, CAP_NET_ADMIN))

net/bridge/br_sysfs_if.c

345

if (!ns_capable(dev_net(p->dev)->user_ns, CAP_NET_ADMIN))

net/bridge/netfilter/ebtables.c

2494

if (!ns_capable(net->user_ns, CAP_NET_ADMIN))

net/bridge/netfilter/ebtables.c

2561

if (!ns_capable(net->user_ns, CAP_NET_ADMIN))

net/core/dev_ioctl.c

766

if (!ns_capable(net->user_ns, CAP_NET_ADMIN))

net/core/dev_ioctl.c

808

if (!ns_capable(net->user_ns, CAP_NET_ADMIN))

net/core/net-sysfs.c

167

if (!ns_capable(net->user_ns, CAP_NET_ADMIN))

net/core/net-sysfs.c

1858

if (!ns_capable(net->user_ns, CAP_NET_ADMIN))

net/core/net-sysfs.c

198

if (!ns_capable(net->user_ns, CAP_NET_ADMIN))

net/core/net-sysfs.c

2164

return ns_capable(net->user_ns, CAP_SYS_ADMIN);

net/core/net-sysfs.c

568

if (!ns_capable(net->user_ns, CAP_NET_ADMIN))

net/core/net_namespace.c

1534

if (!ns_capable(net->user_ns, CAP_SYS_ADMIN) ||

net/core/net_namespace.c

1535

!ns_capable(nsset->cred->user_ns, CAP_SYS_ADMIN))

net/core/rtnetlink.c

2445

ns_capable(link_net->user_ns, CAP_NET_ADMIN);

net/core/rtnetlink.c

7111

if (!ns_capable(net->user_ns, CAP_NET_ADMIN))

net/core/scm.c

59

ns_capable(task_active_pid_ns(current)->user_ns, CAP_SYS_ADMIN)) &&

net/core/scm.c

61

uid_eq(uid, cred->suid)) || ns_capable(cred->user_ns, CAP_SETUID)) &&

net/core/scm.c

63

gid_eq(gid, cred->sgid)) || ns_capable(cred->user_ns, CAP_SETGID))) {

net/core/sock.c

1169

return has_current_bpf_ctx() || ns_capable(ns, cap);

net/core/sock.c

175

ns_capable(user_ns, cap);

net/core/sock.c

3036

if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_RAW) &&

net/core/sock.c

3037

!ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN))

net/core/sock.c

642

if (sk->sk_bound_dev_if && !ns_capable(net->user_ns, CAP_NET_RAW))

net/core/sock_diag.c

314

if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN))

net/ethtool/ioctl.c

3327

if (!ns_capable(net->user_ns, CAP_NET_ADMIN))

net/ieee802154/socket.c

905

if (!ns_capable(net->user_ns, CAP_NET_ADMIN) &&

net/ieee802154/socket.c

906

!ns_capable(net->user_ns, CAP_NET_RAW)) {

net/ieee802154/socket.c

929

if (!ns_capable(net->user_ns, CAP_NET_ADMIN) &&

net/ieee802154/socket.c

930

!ns_capable(net->user_ns, CAP_NET_RAW)) {

net/ipv4/af_inet.c

322

!ns_capable(net->user_ns, CAP_NET_RAW))

net/ipv4/af_inet.c

518

!ns_capable(net->user_ns, CAP_NET_BIND_SERVICE))

net/ipv4/arp.c

1274

if (!ns_capable(net->user_ns, CAP_NET_ADMIN))

net/ipv4/devinet.c

1101

if (!ns_capable(net->user_ns, CAP_NET_ADMIN))

net/ipv4/devinet.c

1109

if (!ns_capable(net->user_ns, CAP_NET_ADMIN))

net/ipv4/devinet.c

2616

if (write && !ns_capable(net->user_ns, CAP_NET_ADMIN))

net/ipv4/fib_frontend.c

635

if (!ns_capable(net->user_ns, CAP_NET_ADMIN))

net/ipv4/ip_options.c

396

if (!skb && !ns_capable(net->user_ns, CAP_NET_RAW)) {

net/ipv4/ip_options.c

431

if ((!skb && !ns_capable(net->user_ns, CAP_NET_RAW)) || opt->cipso) {

net/ipv4/ip_options.c

444

if (!skb && !ns_capable(net->user_ns, CAP_NET_RAW)) {

net/ipv4/ip_options.c

533

if (opt->opt.srr && !ns_capable(net->user_ns, CAP_NET_RAW)) {

net/ipv4/ip_tunnel.c

918

if (!ns_capable(net->user_ns, CAP_NET_ADMIN))

net/ipv4/ip_tunnel.c

974

if (!ns_capable(net->user_ns, CAP_NET_ADMIN))

net/ipv4/ipmr.c

1436

!ns_capable(net->user_ns, CAP_NET_ADMIN)) {

net/ipv4/netfilter/arp_tables.c

1428

if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN))

net/ipv4/netfilter/arp_tables.c

1458

if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN))

net/ipv4/netfilter/ip_tables.c

1622

if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN))

net/ipv4/netfilter/ip_tables.c

1653

if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN))

net/ipv6/addrconf.c

3170

if (!ns_capable(net->user_ns, CAP_NET_ADMIN))

net/ipv6/addrconf.c

3197

if (!ns_capable(net->user_ns, CAP_NET_ADMIN))

net/ipv6/af_inet6.c

167

!ns_capable(net->user_ns, CAP_NET_RAW))

net/ipv6/af_inet6.c

288

!ns_capable(net->user_ns, CAP_NET_BIND_SERVICE))

net/ipv6/anycast.c

77

if (!ns_capable(net->user_ns, CAP_NET_ADMIN))

net/ipv6/datagram.c

915

if (!ns_capable(net->user_ns, CAP_NET_RAW)) {

net/ipv6/datagram.c

935

if (!ns_capable(net->user_ns, CAP_NET_RAW)) {

net/ipv6/datagram.c

960

if (!ns_capable(net->user_ns, CAP_NET_RAW)) {

net/ipv6/ip6_flowlabel.c

601

ns_capable(net->user_ns, CAP_NET_ADMIN)) {

net/ipv6/ip6_gre.c

1288

if (!ns_capable(net->user_ns, CAP_NET_ADMIN))

net/ipv6/ip6_gre.c

1337

if (!ns_capable(net->user_ns, CAP_NET_ADMIN))

net/ipv6/ip6_tunnel.c

1686

if (!ns_capable(net->user_ns, CAP_NET_ADMIN))

net/ipv6/ip6_tunnel.c

1722

if (!ns_capable(net->user_ns, CAP_NET_ADMIN))

net/ipv6/ip6_vti.c

831

if (!ns_capable(net->user_ns, CAP_NET_ADMIN))

net/ipv6/ip6_vti.c

844

if (!ns_capable(self->net->user_ns, CAP_NET_ADMIN))

net/ipv6/ip6_vti.c

870

if (!ns_capable(net->user_ns, CAP_NET_ADMIN))

net/ipv6/ip6mr.c

1731

!ns_capable(net->user_ns, CAP_NET_ADMIN))

net/ipv6/netfilter/ip6_tables.c

1631

if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN))

net/ipv6/netfilter/ip6_tables.c

1662

if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN))

net/ipv6/route.c

4585

if (!ns_capable(net->user_ns, CAP_NET_ADMIN))

net/ipv6/sit.c

1227

if (!ns_capable(t->net->user_ns, CAP_NET_ADMIN))

net/ipv6/sit.c

1256

if (!ns_capable(net->user_ns, CAP_NET_ADMIN))

net/ipv6/sit.c

1335

if (!ns_capable(t->net->user_ns, CAP_NET_ADMIN))

net/ipv6/sit.c

465

if (!ns_capable(t->net->user_ns, CAP_NET_ADMIN))

net/key/af_key.c

145

if (!ns_capable(net->user_ns, CAP_NET_ADMIN))

net/llc/af_llc.c

172

if (!ns_capable(net->user_ns, CAP_NET_RAW))

net/mptcp/sockopt.c

611

cap_net_admin = ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN);

net/netfilter/ipset/ip_set_core.c

2257

if (!ns_capable(net->user_ns, CAP_NET_ADMIN))

net/netfilter/ipvs/ip_vs_ctl.c

3436

if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN))

net/netfilter/ipvs/ip_vs_ctl.c

3743

if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN))

net/netlink/af_netlink.c

1703

if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_BROADCAST))

net/netlink/af_netlink.c

853

ns_capable(user_ns, cap);

net/netlink/af_netlink.c

908

ns_capable(sock_net(sock->sk)->user_ns, CAP_NET_ADMIN);

net/netlink/genetlink.c

1832

!ns_capable(net->user_ns, CAP_NET_ADMIN))

net/netlink/genetlink.c

1835

!ns_capable(net->user_ns, CAP_SYS_ADMIN))

net/nfc/rawsock.c

345

if (!ns_capable(net->user_ns, CAP_NET_RAW))

net/packet/af_packet.c

3346

if (!ns_capable(net->user_ns, CAP_NET_RAW))

net/sctp/socket.c

1087

!ns_capable(net->user_ns, CAP_NET_BIND_SERVICE))

net/sctp/socket.c

419

!ns_capable(net->user_ns, CAP_NET_BIND_SERVICE))

net/socket.c

1390

if (!ns_capable(net->user_ns, CAP_NET_ADMIN))

net/unix/af_unix.c

3275

if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN))

net/wireless/nl80211.c

14212

if (!ns_capable(net->user_ns, CAP_NET_ADMIN)) {

net/xdp/xsk.c

1976

if (!ns_capable(net->user_ns, CAP_NET_RAW))

security/commoncap.c

1042

if (!ns_capable(user_ns, CAP_SYS_ADMIN))

security/commoncap.c

1086

if (!ns_capable(user_ns, CAP_SYS_ADMIN))

security/commoncap.c

1215

if (!is_subset && !ns_capable(__task_cred(p)->user_ns, CAP_SYS_NICE))

security/commoncap.c

1274

if (!ns_capable(current_user_ns(), CAP_SETPCAP))

security/commoncap.c

180

if (ns_capable(child_cred->user_ns, CAP_SYS_PTRACE))

security/commoncap.c

590

if (ns_capable(inode->i_sb->s_user_ns, CAP_SETFCAP))

security/commoncap.c

954

if (!ns_capable(new->user_ns, CAP_SETUID) ||

security/keys/persistent.c

149

!ns_capable(ns, CAP_SETUID))

security/yama/yama_lsm.c

366

!ns_capable(__task_cred(child)->user_ns, CAP_SYS_PTRACE))

security/yama/yama_lsm.c

372

if (!ns_capable(__task_cred(child)->user_ns, CAP_SYS_PTRACE))