cgroup-v1: Require capabilities to set release_agent

commit 24f6008564183aa120d07c03d9289519c2fe02af upstream.

The cgroup release_agent is called with call_usermodehelper.  The function
call_usermodehelper starts the release_agent with a full set fo capabilities.
Therefore require capabilities when setting the release_agaent.

Reported-by: Tabitha Sable <>
Tested-by: Tabitha Sable <>
Fixes: 81a6a5cdd2c5 ("Task Control Groups: automatic userspace notification of idle cgroups")
Cc: # v2.6.24+
Signed-off-by: "Eric W. Biederman" <>
Signed-off-by: Tejun Heo <>
Signed-off-by: Greg Kroah-Hartman <>
1 file changed