aboutsummaryrefslogtreecommitdiffstats
path: root/fs/namei.c
diff options
context:
space:
mode:
Diffstat (limited to 'fs/namei.c')
-rw-r--r--fs/namei.c18
1 files changed, 5 insertions, 13 deletions
diff --git a/fs/namei.c b/fs/namei.c
index 701954d68ac7..941c4362e298 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -228,9 +228,6 @@ static int acl_permission_check(struct inode *inode, int mask)
228{ 228{
229 unsigned int mode = inode->i_mode; 229 unsigned int mode = inode->i_mode;
230 230
231 if (current_user_ns() != inode_userns(inode))
232 goto other_perms;
233
234 if (likely(current_fsuid() == inode->i_uid)) 231 if (likely(current_fsuid() == inode->i_uid))
235 mode >>= 6; 232 mode >>= 6;
236 else { 233 else {
@@ -244,7 +241,6 @@ static int acl_permission_check(struct inode *inode, int mask)
244 mode >>= 3; 241 mode >>= 3;
245 } 242 }
246 243
247other_perms:
248 /* 244 /*
249 * If the DACs are ok we don't need any capability check. 245 * If the DACs are ok we don't need any capability check.
250 */ 246 */
@@ -280,10 +276,10 @@ int generic_permission(struct inode *inode, int mask)
280 276
281 if (S_ISDIR(inode->i_mode)) { 277 if (S_ISDIR(inode->i_mode)) {
282 /* DACs are overridable for directories */ 278 /* DACs are overridable for directories */
283 if (ns_capable(inode_userns(inode), CAP_DAC_OVERRIDE)) 279 if (inode_capable(inode, CAP_DAC_OVERRIDE))
284 return 0; 280 return 0;
285 if (!(mask & MAY_WRITE)) 281 if (!(mask & MAY_WRITE))
286 if (ns_capable(inode_userns(inode), CAP_DAC_READ_SEARCH)) 282 if (inode_capable(inode, CAP_DAC_READ_SEARCH))
287 return 0; 283 return 0;
288 return -EACCES; 284 return -EACCES;
289 } 285 }
@@ -293,7 +289,7 @@ int generic_permission(struct inode *inode, int mask)
293 * at least one exec bit set. 289 * at least one exec bit set.
294 */ 290 */
295 if (!(mask & MAY_EXEC) || (inode->i_mode & S_IXUGO)) 291 if (!(mask & MAY_EXEC) || (inode->i_mode & S_IXUGO))
296 if (ns_capable(inode_userns(inode), CAP_DAC_OVERRIDE)) 292 if (inode_capable(inode, CAP_DAC_OVERRIDE))
297 return 0; 293 return 0;
298 294
299 /* 295 /*
@@ -301,7 +297,7 @@ int generic_permission(struct inode *inode, int mask)
301 */ 297 */
302 mask &= MAY_READ | MAY_WRITE | MAY_EXEC; 298 mask &= MAY_READ | MAY_WRITE | MAY_EXEC;
303 if (mask == MAY_READ) 299 if (mask == MAY_READ)
304 if (ns_capable(inode_userns(inode), CAP_DAC_READ_SEARCH)) 300 if (inode_capable(inode, CAP_DAC_READ_SEARCH))
305 return 0; 301 return 0;
306 302
307 return -EACCES; 303 return -EACCES;
@@ -1964,15 +1960,11 @@ static inline int check_sticky(struct inode *dir, struct inode *inode)
1964 1960
1965 if (!(dir->i_mode & S_ISVTX)) 1961 if (!(dir->i_mode & S_ISVTX))
1966 return 0; 1962 return 0;
1967 if (current_user_ns() != inode_userns(inode))
1968 goto other_userns;
1969 if (inode->i_uid == fsuid) 1963 if (inode->i_uid == fsuid)
1970 return 0; 1964 return 0;
1971 if (dir->i_uid == fsuid) 1965 if (dir->i_uid == fsuid)
1972 return 0; 1966 return 0;
1973 1967 return !inode_capable(inode, CAP_FOWNER);
1974other_userns:
1975 return !ns_capable(inode_userns(inode), CAP_FOWNER);
1976} 1968}
1977 1969
1978/* 1970/*