Unverified Commit 9891d2f7 authored by Serge Hallyn's avatar Serge Hallyn Committed by Serge Hallyn
Browse files

Clarify the rootid_owns_currentns 



Split most of the rootid_owns_currentns() functionality
into a more generic rootid_owns_ns() function which
will be easier to write tests for.

Rename the functions and variables to make clear that
the ids being tested could be any uid.

Signed-off-by: default avatarSerge Hallyn <serge@hallyn.com>
CC: Ryan Foster <foster.ryan.r@gmail.com>
CC: Christian Brauner <brauner@kernel.org>

---
v2: change the function parameter documentation to mollify the bot.
parent 211ddde0

security/commoncap.c

+22 −12
Original line number Diff line number Diff line
@@ -358,17 +358,17 @@ int cap_inode_killpriv(struct mnt_idmap *idmap, struct dentry *dentry) 
	return error;

}



static bool rootid_owns_currentns(vfsuid_t rootvfsuid)

/**

 * kuid_root_in_ns - check whether the given kuid is root in the given ns

 * @kuid: the kuid to be tested

 * @ns: the user namespace to test against

 *

 * Returns true if @kuid represents the root user in @ns, false otherwise.

 */

static bool kuid_root_in_ns(kuid_t kuid, struct user_namespace *ns)

{

	struct user_namespace *ns;

	kuid_t kroot;



	if (!vfsuid_valid(rootvfsuid))

		return false;



	kroot = vfsuid_into_kuid(rootvfsuid);

	for (ns = current_user_ns();; ns = ns->parent) {

		if (from_kuid(ns, kroot) == 0)

	for (;; ns = ns->parent) {

		if (from_kuid(ns, kuid) == 0)

			return true;

		if (ns == &init_user_ns)

			break;
@@ -377,6 +377,16 @@ static bool rootid_owns_currentns(vfsuid_t rootvfsuid) 
	return false;

}



static bool vfsuid_root_in_currentns(vfsuid_t vfsuid)

{

	kuid_t kuid;



	if (!vfsuid_valid(vfsuid))

		return false;

	kuid = vfsuid_into_kuid(vfsuid);

	return kuid_root_in_ns(kuid, current_user_ns());

}



static __u32 sansflags(__u32 m)

{

	return m & ~VFS_CAP_FLAGS_EFFECTIVE;
@@ -481,7 +491,7 @@ int cap_inode_getsecurity(struct mnt_idmap *idmap, 
		goto out_free;

	}



	if (!rootid_owns_currentns(vfsroot)) {

	if (!vfsuid_root_in_currentns(vfsroot)) {

		size = -EOVERFLOW;

		goto out_free;

	}
@@ -722,7 +732,7 @@ int get_vfs_caps_from_disk(struct mnt_idmap *idmap, 
	/* Limit the caps to the mounter of the filesystem

	 * or the more limited uid specified in the xattr.

	 */

	if (!rootid_owns_currentns(rootvfsuid))

	if (!vfsuid_root_in_currentns(rootvfsuid))

		return -ENODATA;



	cpu_caps->permitted.val = le32_to_cpu(caps->data[0].permitted);