MIME-Version: 1.0
In-Reply-To: <1431689523.1769.1.camel@samsung.com>
References: <cover.1431671529.git.luto@kernel.org> <cc4749638a21079cce12f9f30c806170558e56e5.1431671529.git.luto@kernel.org>
 <1431689523.1769.1.camel@samsung.com>
From: Andy Lutomirski <luto@amacapital.net>
Date: Fri, 15 May 2015 05:03:27 -0700
Message-ID: <CALCETrUGivM6Jafp5npznsoUZQX04vzS+xr4HED5J4EbYD2OwQ@mail.gmail.com>
Subject: Re: [PATCH v2 1/2] capabilities: Ambient capabilities
To: Lukasz Pawelczyk <l.pawelczyk@samsung.com>
Cc: Andy Lutomirski <luto@kernel.org>, Serge Hallyn <serge.hallyn@ubuntu.com>,
        Andrew Morton <akpm@linuxfoundation.org>,
        Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>,
        "Ted Ts'o" <tytso@mit.edu>, "Andrew G. Morgan" <morgan@kernel.org>,
        Linux API <linux-api@vger.kernel.org>,
        Mimi Zohar <zohar@linux.vnet.ibm.com>,
        Michael Kerrisk <mtk.manpages@gmail.com>,
        Austin S Hemmelgarn <ahferroin7@gmail.com>,
        linux-security-module <linux-security-module@vger.kernel.org>,
        Aaron Jones <aaronmdjones@gmail.com>,
        Serge Hallyn <serge.hallyn@canonical.com>,
        LKML <linux-kernel@vger.kernel.org>, Markku Savela <msa@moth.iki.fi>,
        Kees Cook <keescook@chromium.org>, Jonathan Corbet <corbet@lwn.net>,
        Christoph Lameter <cl@linux.com>
Content-Type: text/plain; charset=UTF-8
Sender: linux-kernel-owner@vger.kernel.org
Content-Length: 1276
Lines: 31

On Fri, May 15, 2015 at 4:32 AM, Lukasz Pawelczyk
<l.pawelczyk@samsung.com> wrote:
> On czw, 2015-05-14 at 23:39 -0700, Andy Lutomirski wrote:
>> @@ -696,10 +729,18 @@ static inline void cap_emulate_setxuid(struct cred *new, const struct cred *old)
>>            uid_eq(old->suid, root_uid)) &&
>>           (!uid_eq(new->uid, root_uid) &&
>>            !uid_eq(new->euid, root_uid) &&
>> -          !uid_eq(new->suid, root_uid)) &&
>> -         !issecure(SECURE_KEEP_CAPS)) {
>> -             cap_clear(new->cap_permitted);
>> -             cap_clear(new->cap_effective);
>> +          !uid_eq(new->suid, root_uid))) {
>> +             if (!issecure(SECURE_KEEP_CAPS)) {
>> +                     cap_clear(new->cap_permitted);
>> +                     cap_clear(new->cap_effective);
>> +             }
>> +
>> +             /*
>> +              * Pre-ambient programs except setresuid to nonroot followed
>
> I think you meant "expect". This typo changes the meaning of the
> sentence.

Good catch.  I'll fix that for v3.

--Andy
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/