capabilities: use root_priveleged inline to clarify logic
Introduce inline root_privileged() to make use of SECURE_NONROOT easier to read. Suggested-by: Serge Hallyn <serge@hallyn.com> Signed-off-by: Richard Guy Briggs <rgb@redhat.com> Reviewed-by: Serge Hallyn <serge@hallyn.com> Acked-by: James Morris <james.l.morris@oracle.com> Acked-by: Kees Cook <keescook@chromium.org> Okay-ished-by: Paul Moore <paul@paul-moore.com> Signed-off-by: James Morris <james.l.morris@oracle.com>
This commit is contained in:
parent
fc7eadf768
commit
9304b46c91
|
@ -695,6 +695,8 @@ out:
|
||||||
return rc;
|
return rc;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
static inline bool root_privileged(void) { return !issecure(SECURE_NOROOT); }
|
||||||
|
|
||||||
/*
|
/*
|
||||||
* handle_privileged_root - Handle case of privileged root
|
* handle_privileged_root - Handle case of privileged root
|
||||||
* @bprm: The execution parameters, including the proposed creds
|
* @bprm: The execution parameters, including the proposed creds
|
||||||
|
@ -713,7 +715,7 @@ static void handle_privileged_root(struct linux_binprm *bprm, bool has_fcap,
|
||||||
const struct cred *old = current_cred();
|
const struct cred *old = current_cred();
|
||||||
struct cred *new = bprm->cred;
|
struct cred *new = bprm->cred;
|
||||||
|
|
||||||
if (issecure(SECURE_NOROOT))
|
if (!root_privileged())
|
||||||
return;
|
return;
|
||||||
/*
|
/*
|
||||||
* If the legacy file capability is set, then don't set privs
|
* If the legacy file capability is set, then don't set privs
|
||||||
|
@ -838,7 +840,7 @@ int cap_bprm_set_creds(struct linux_binprm *bprm)
|
||||||
if (__cap_grew(effective, ambient, new)) {
|
if (__cap_grew(effective, ambient, new)) {
|
||||||
if (!__cap_full(effective, new) ||
|
if (!__cap_full(effective, new) ||
|
||||||
!uid_eq(new->euid, root_uid) || !uid_eq(new->uid, root_uid) ||
|
!uid_eq(new->euid, root_uid) || !uid_eq(new->uid, root_uid) ||
|
||||||
issecure(SECURE_NOROOT)) {
|
!root_privileged()) {
|
||||||
ret = audit_log_bprm_fcaps(bprm, new, old);
|
ret = audit_log_bprm_fcaps(bprm, new, old);
|
||||||
if (ret < 0)
|
if (ret < 0)
|
||||||
return ret;
|
return ret;
|
||||||
|
|
Loading…
Reference in New Issue