diff options
author | Richard Guy Briggs <rgb@redhat.com> | 2017-10-11 20:57:08 -0400 |
---|---|---|
committer | James Morris <james.l.morris@oracle.com> | 2017-10-20 00:22:44 -0400 |
commit | 9304b46c912d65a103a68f093b456ba3c02dca3b (patch) | |
tree | 7ff1e1cf15cee3bf54b31956977c4133fb3ca751 | |
parent | fc7eadf768a3e2c062e52eea89b52a0076d53b0c (diff) |
capabilities: use root_priveleged inline to clarify logic
Introduce inline root_privileged() to make use of SECURE_NONROOT
easier to read.
Suggested-by: Serge Hallyn <serge@hallyn.com>
Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
Reviewed-by: Serge Hallyn <serge@hallyn.com>
Acked-by: James Morris <james.l.morris@oracle.com>
Acked-by: Kees Cook <keescook@chromium.org>
Okay-ished-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: James Morris <james.l.morris@oracle.com>
-rw-r--r-- | security/commoncap.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/security/commoncap.c b/security/commoncap.c index 13661d34f842..9b8a6e79d858 100644 --- a/security/commoncap.c +++ b/security/commoncap.c | |||
@@ -695,6 +695,8 @@ out: | |||
695 | return rc; | 695 | return rc; |
696 | } | 696 | } |
697 | 697 | ||
698 | static inline bool root_privileged(void) { return !issecure(SECURE_NOROOT); } | ||
699 | |||
698 | /* | 700 | /* |
699 | * handle_privileged_root - Handle case of privileged root | 701 | * handle_privileged_root - Handle case of privileged root |
700 | * @bprm: The execution parameters, including the proposed creds | 702 | * @bprm: The execution parameters, including the proposed creds |
@@ -713,7 +715,7 @@ static void handle_privileged_root(struct linux_binprm *bprm, bool has_fcap, | |||
713 | const struct cred *old = current_cred(); | 715 | const struct cred *old = current_cred(); |
714 | struct cred *new = bprm->cred; | 716 | struct cred *new = bprm->cred; |
715 | 717 | ||
716 | if (issecure(SECURE_NOROOT)) | 718 | if (!root_privileged()) |
717 | return; | 719 | return; |
718 | /* | 720 | /* |
719 | * If the legacy file capability is set, then don't set privs | 721 | * If the legacy file capability is set, then don't set privs |
@@ -838,7 +840,7 @@ int cap_bprm_set_creds(struct linux_binprm *bprm) | |||
838 | if (__cap_grew(effective, ambient, new)) { | 840 | if (__cap_grew(effective, ambient, new)) { |
839 | if (!__cap_full(effective, new) || | 841 | if (!__cap_full(effective, new) || |
840 | !uid_eq(new->euid, root_uid) || !uid_eq(new->uid, root_uid) || | 842 | !uid_eq(new->euid, root_uid) || !uid_eq(new->uid, root_uid) || |
841 | issecure(SECURE_NOROOT)) { | 843 | !root_privileged()) { |
842 | ret = audit_log_bprm_fcaps(bprm, new, old); | 844 | ret = audit_log_bprm_fcaps(bprm, new, old); |
843 | if (ret < 0) | 845 | if (ret < 0) |
844 | return ret; | 846 | return ret; |