Commit cc658db4 authored by Kees Cook's avatar Kees Cook Committed by Al Viro

fs: Reorder inode_owner_or_capable() to avoid needless

Checking for capabilities should be the last operation when performing
access control tests so that PF_SUPERPRIV is set only when it was required
for success (implying that the capability was needed for the operation).
Reported-by: default avatarSolar Designer <solar@openwall.com>
Signed-off-by: default avatarKees Cook <keescook@chromium.org>
Acked-by: default avatarSerge Hallyn <serge@hallyn.com>
Reviewed-by: default avatarAndy Lutomirski <luto@kernel.org>
Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
parent 41124db8
...@@ -2023,7 +2023,7 @@ bool inode_owner_or_capable(const struct inode *inode) ...@@ -2023,7 +2023,7 @@ bool inode_owner_or_capable(const struct inode *inode)
return true; return true;
ns = current_user_ns(); ns = current_user_ns();
if (ns_capable(ns, CAP_FOWNER) && kuid_has_mapping(ns, inode->i_uid)) if (kuid_has_mapping(ns, inode->i_uid) && ns_capable(ns, CAP_FOWNER))
return true; return true;
return false; return false;
} }
......
...@@ -1008,7 +1008,7 @@ static int may_linkat(struct path *link) ...@@ -1008,7 +1008,7 @@ static int may_linkat(struct path *link)
/* Source inode owner (or CAP_FOWNER) can hardlink all they like, /* Source inode owner (or CAP_FOWNER) can hardlink all they like,
* otherwise, it must be a safe source. * otherwise, it must be a safe source.
*/ */
if (inode_owner_or_capable(inode) || safe_hardlink_source(inode)) if (safe_hardlink_source(inode) || inode_owner_or_capable(inode))
return 0; return 0;
audit_log_link_denied("linkat", link); audit_log_link_denied("linkat", link);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment