Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 25e75703 authored by Eric Paris's avatar Eric Paris
Browse files

capabilities: call has_ns_capability from has_capability 



Declare the more specific has_ns_capability first in the code and then call it
from has_capability.  The declaration reversal isn't stricty necessary since
they are both declared in header files, but it just makes sense to put more
specific functions first in the code.

Signed-off-by: default avatarEric Paris <eparis@redhat.com>
Acked-by: default avatarSerge E. Hallyn <serge.hallyn@canonical.com>
parent 2920a840

kernel/capability.c

+10 −16
Original line number Diff line number Diff line
@@ -287,47 +287,41 @@ error: 
}



/**

 * has_capability - Does a task have a capability in init_user_ns

 * has_ns_capability - Does a task have a capability in a specific user ns

 * @t: The task in question

 * @ns: target user namespace

 * @cap: The capability to be tested for

 *

 * Return true if the specified task has the given superior capability

 * currently in effect to the initial user namespace, false if not.

 * currently in effect to the specified user namespace, false if not.

 *

 * Note that this does not set PF_SUPERPRIV on the task.

 */

bool has_capability(struct task_struct *t, int cap)

bool has_ns_capability(struct task_struct *t,

		       struct user_namespace *ns, int cap)

{

	int ret;



	rcu_read_lock();

	ret = security_capable(__task_cred(t), &init_user_ns, cap);

	ret = security_capable(__task_cred(t), ns, cap);

	rcu_read_unlock();



	return (ret == 0);

}



/**

 * has_capability - Does a task have a capability in a specific user ns

 * has_capability - Does a task have a capability in init_user_ns

 * @t: The task in question

 * @ns: target user namespace

 * @cap: The capability to be tested for

 *

 * Return true if the specified task has the given superior capability

 * currently in effect to the specified user namespace, false if not.

 * currently in effect to the initial user namespace, false if not.

 *

 * Note that this does not set PF_SUPERPRIV on the task.

 */

bool has_ns_capability(struct task_struct *t,

		       struct user_namespace *ns, int cap)

bool has_capability(struct task_struct *t, int cap)

{

	int ret;



	rcu_read_lock();

	ret = security_capable(__task_cred(t), ns, cap);

	rcu_read_unlock();



	return (ret == 0);

	return has_ns_capability(t, &init_user_ns, cap);

}



/**