cgroup-v1: Require capabilities to set release_agent

commit 24f6008564183aa120d07c03d9289519c2fe02af upstream.

The cgroup release_agent is called with call_usermodehelper.  The function
call_usermodehelper starts the release_agent with a full set fo capabilities.
Therefore require capabilities when setting the release_agaent.

RELEASE_NOTE=This resolves CVE-2022-0492

cos-patch: security-moderate
Reported-by: Tabitha Sable <>
Tested-by: Tabitha Sable <>
Fixes: 81a6a5cdd2c5 ("Task Control Groups: automatic userspace notification of idle cgroups")
Cc: # v2.6.24+
Signed-off-by: "Eric W. Biederman" <>
Signed-off-by: Tejun Heo <>
Signed-off-by: Greg Kroah-Hartman <>
Change-Id: I9bb8dbc0eb53e9ca4cc0f20a934604d14ce29369
Reviewed-by: Robert Kolchmeyer <>
Tested-by: Roy Yang <>
1 file changed