aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorRichard Guy Briggs <rgb@redhat.com>2017-10-11 20:57:08 -0400
committerJames Morris <james.l.morris@oracle.com>2017-10-20 00:22:44 -0400
commit9304b46c912d65a103a68f093b456ba3c02dca3b (patch)
tree7ff1e1cf15cee3bf54b31956977c4133fb3ca751
parentfc7eadf768a3e2c062e52eea89b52a0076d53b0c (diff)
capabilities: use root_priveleged inline to clarify logic
Introduce inline root_privileged() to make use of SECURE_NONROOT easier to read. Suggested-by: Serge Hallyn <serge@hallyn.com> Signed-off-by: Richard Guy Briggs <rgb@redhat.com> Reviewed-by: Serge Hallyn <serge@hallyn.com> Acked-by: James Morris <james.l.morris@oracle.com> Acked-by: Kees Cook <keescook@chromium.org> Okay-ished-by: Paul Moore <paul@paul-moore.com> Signed-off-by: James Morris <james.l.morris@oracle.com>
-rw-r--r--security/commoncap.c6
1 files changed, 4 insertions, 2 deletions
diff --git a/security/commoncap.c b/security/commoncap.c
index 13661d34f842..9b8a6e79d858 100644
--- a/security/commoncap.c
+++ b/security/commoncap.c
@@ -695,6 +695,8 @@ out:
695 return rc; 695 return rc;
696} 696}
697 697
698static inline bool root_privileged(void) { return !issecure(SECURE_NOROOT); }
699
698/* 700/*
699 * handle_privileged_root - Handle case of privileged root 701 * handle_privileged_root - Handle case of privileged root
700 * @bprm: The execution parameters, including the proposed creds 702 * @bprm: The execution parameters, including the proposed creds
@@ -713,7 +715,7 @@ static void handle_privileged_root(struct linux_binprm *bprm, bool has_fcap,
713 const struct cred *old = current_cred(); 715 const struct cred *old = current_cred();
714 struct cred *new = bprm->cred; 716 struct cred *new = bprm->cred;
715 717
716 if (issecure(SECURE_NOROOT)) 718 if (!root_privileged())
717 return; 719 return;
718 /* 720 /*
719 * If the legacy file capability is set, then don't set privs 721 * If the legacy file capability is set, then don't set privs
@@ -838,7 +840,7 @@ int cap_bprm_set_creds(struct linux_binprm *bprm)
838 if (__cap_grew(effective, ambient, new)) { 840 if (__cap_grew(effective, ambient, new)) {
839 if (!__cap_full(effective, new) || 841 if (!__cap_full(effective, new) ||
840 !uid_eq(new->euid, root_uid) || !uid_eq(new->uid, root_uid) || 842 !uid_eq(new->euid, root_uid) || !uid_eq(new->uid, root_uid) ||
841 issecure(SECURE_NOROOT)) { 843 !root_privileged()) {
842 ret = audit_log_bprm_fcaps(bprm, new, old); 844 ret = audit_log_bprm_fcaps(bprm, new, old);
843 if (ret < 0) 845 if (ret < 0)
844 return ret; 846 return ret;