Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9304b46c authored by Richard Guy Briggs's avatar Richard Guy Briggs Committed by James Morris
Browse files

capabilities: use root_priveleged inline to clarify logic 



Introduce inline root_privileged() to make use of SECURE_NONROOT
easier to read.

Suggested-by: default avatarSerge Hallyn <serge@hallyn.com>
Signed-off-by: default avatarRichard Guy Briggs <rgb@redhat.com>
Reviewed-by: default avatarSerge Hallyn <serge@hallyn.com>
Acked-by: default avatarJames Morris <james.l.morris@oracle.com>
Acked-by: default avatarKees Cook <keescook@chromium.org>
Okay-ished-by: default avatarPaul Moore <paul@paul-moore.com>
Signed-off-by: default avatarJames Morris <james.l.morris@oracle.com>
parent fc7eadf7

security/commoncap.c

+4 −2
Original line number Diff line number Diff line
@@ -695,6 +695,8 @@ static int get_file_caps(struct linux_binprm *bprm, bool *effective, bool *has_f 
	return rc;

}



static inline bool root_privileged(void) { return !issecure(SECURE_NOROOT); }



/*

 * handle_privileged_root - Handle case of privileged root

 * @bprm: The execution parameters, including the proposed creds
@@ -713,7 +715,7 @@ static void handle_privileged_root(struct linux_binprm *bprm, bool has_fcap, 
	const struct cred *old = current_cred();

	struct cred *new = bprm->cred;



	if (issecure(SECURE_NOROOT))

	if (!root_privileged())

		return;

	/*

	 * If the legacy file capability is set, then don't set privs
@@ -838,7 +840,7 @@ int cap_bprm_set_creds(struct linux_binprm *bprm) 
	if (__cap_grew(effective, ambient, new)) {

		if (!__cap_full(effective, new) ||

		    !uid_eq(new->euid, root_uid) || !uid_eq(new->uid, root_uid) ||

		    issecure(SECURE_NOROOT)) {

		    !root_privileged()) {

			ret = audit_log_bprm_fcaps(bprm, new, old);

			if (ret < 0)

				return ret;