Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 7b61d648 authored by Eric Paris's avatar Eric Paris
Browse files

capabilites: introduce new has_ns_capabilities_noaudit 



For consistency in interfaces, introduce a new interface called
has_ns_capabilities_noaudit.  It checks if the given task has the given
capability in the given namespace.  Use this new function by
has_capabilities_noaudit.

Signed-off-by: default avatarEric Paris <eparis@redhat.com>
Acked-by: default avatarSerge E. Hallyn <serge.hallyn@canonical.com>
parent 25e75703

include/linux/capability.h

+2 −0
Original line number Original line Diff line number Diff line
@@ -543,6 +543,8 @@ extern bool has_capability(struct task_struct *t, int cap); 
extern bool has_ns_capability(struct task_struct *t,

extern bool has_ns_capability(struct task_struct *t,

			      struct user_namespace *ns, int cap);

			      struct user_namespace *ns, int cap);

extern bool has_capability_noaudit(struct task_struct *t, int cap);

extern bool has_capability_noaudit(struct task_struct *t, int cap);

extern bool has_ns_capability_noaudit(struct task_struct *t,

				      struct user_namespace *ns, int cap);

extern bool capable(int cap);

extern bool capable(int cap);

extern bool ns_capable(struct user_namespace *ns, int cap);

extern bool ns_capable(struct user_namespace *ns, int cap);

extern bool task_ns_capable(struct task_struct *t, int cap);

extern bool task_ns_capable(struct task_struct *t, int cap);

kernel/capability.c

+25 −5
Original line number Original line Diff line number Diff line
@@ -325,27 +325,47 @@ bool has_capability(struct task_struct *t, int cap) 
}

}





/**

/**

 * has_capability_noaudit - Does a task have a capability (unaudited)

 * has_ns_capability_noaudit - Does a task have a capability (unaudited)

 * in a specific user ns.

 * @t: The task in question

 * @t: The task in question

 * @ns: target user namespace

 * @cap: The capability to be tested for

 * @cap: The capability to be tested for

 *

 *

 * Return true if the specified task has the given superior capability

 * Return true if the specified task has the given superior capability

 * currently in effect to init_user_ns, false if not.  Don't write an

 * currently in effect to the specified user namespace, false if not.

 * audit message for the check.

 * Do not write an audit message for the check.

 *

 *

 * Note that this does not set PF_SUPERPRIV on the task.

 * Note that this does not set PF_SUPERPRIV on the task.

 */

 */

bool has_capability_noaudit(struct task_struct *t, int cap)

bool has_ns_capability_noaudit(struct task_struct *t,

			       struct user_namespace *ns, int cap)

{

{

	int ret;

	int ret;





	rcu_read_lock();

	rcu_read_lock();

	ret = security_capable_noaudit(__task_cred(t), &init_user_ns, cap);

	ret = security_capable_noaudit(__task_cred(t), ns, cap);

	rcu_read_unlock();

	rcu_read_unlock();





	return (ret == 0);

	return (ret == 0);

}

}





/**

 * has_capability_noaudit - Does a task have a capability (unaudited) in the

 * initial user ns

 * @t: The task in question

 * @cap: The capability to be tested for

 *

 * Return true if the specified task has the given superior capability

 * currently in effect to init_user_ns, false if not.  Don't write an

 * audit message for the check.

 *

 * Note that this does not set PF_SUPERPRIV on the task.

 */

bool has_capability_noaudit(struct task_struct *t, int cap)

{

	return has_ns_capability_noaudit(t, &init_user_ns, cap);

}



/**

/**

 * capable - Determine if the current task has a superior capability in effect

 * capable - Determine if the current task has a superior capability in effect

 * @cap: The capability to be tested for

 * @cap: The capability to be tested for