Emulation/switch-linux
1
0
Fork 0
mirror of https://github.com/fail0verflow/switch-linux.git synced 2025-05-04 02:34:21 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

capabilities: use root_priveleged inline to clarify logic

Browse source 
Introduce inline root_privileged() to make use of SECURE_NONROOT
easier to read.

Suggested-by: Serge Hallyn <serge@hallyn.com>
Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
Reviewed-by: Serge Hallyn <serge@hallyn.com>
Acked-by: James Morris <james.l.morris@oracle.com>
Acked-by: Kees Cook <keescook@chromium.org>
Okay-ished-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: James Morris <james.l.morris@oracle.com>
This commit is contained in:
Richard Guy Briggs 2017-10-11 20:57:08 -04:00 • committed by James Morris
parent fc7eadf768
commit 9304b46c91
1 changed files with 4 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
security/commoncap.c
View file

@ -695,6 +695,8 @@ out:
return rc; return rc;
} }
static inline bool root_privileged(void) { return !issecure(SECURE_NOROOT); }
/* /*
* handle_privileged_root - Handle case of privileged root * handle_privileged_root - Handle case of privileged root
* @bprm: The execution parameters, including the proposed creds * @bprm: The execution parameters, including the proposed creds
@ -713,7 +715,7 @@ static void handle_privileged_root(struct linux_binprm *bprm, bool has_fcap,
const struct cred *old = current_cred(); const struct cred *old = current_cred();
struct cred *new = bprm->cred; struct cred *new = bprm->cred;
if (issecure(SECURE_NOROOT)) if (!root_privileged())
return; return;
/* /*
* If the legacy file capability is set, then don't set privs * If the legacy file capability is set, then don't set privs
@ -838,7 +840,7 @@ int cap_bprm_set_creds(struct linux_binprm *bprm)
if (__cap_grew(effective, ambient, new)) { if (__cap_grew(effective, ambient, new)) {
if (!__cap_full(effective, new) || if (!__cap_full(effective, new) ||
!uid_eq(new->euid, root_uid) || !uid_eq(new->uid, root_uid) || !uid_eq(new->euid, root_uid) || !uid_eq(new->uid, root_uid) ||
issecure(SECURE_NOROOT)) { !root_privileged()) {
ret = audit_log_bprm_fcaps(bprm, new, old); ret = audit_log_bprm_fcaps(bprm, new, old);
if (ret < 0) if (ret < 0)
return ret; return ret;