Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S933744AbdCKBFz (ORCPT ); Fri, 10 Mar 2017 20:05:55 -0500 Received: from namei.org ([65.99.196.166]:34650 "EHLO namei.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932687AbdCKBFo (ORCPT ); Fri, 10 Mar 2017 20:05:44 -0500 Date: Sat, 11 Mar 2017 12:05:30 +1100 (AEDT) From: James Morris To: Stephen Smalley cc: viro@zeniv.linux.org.uk, james.l.morris@oracle.com, serge@hallyn.com, paul@paul-moore.com, john.johansen@canonical.com, linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org, linux-security-module@vger.kernel.org, selinux@tycho.nsa.gov Subject: Re: [PATCH] fs: switch order of CAP_DAC_OVERRIDE and CAP_DAC_READ_SEARCH checks In-Reply-To: <1489166058-11789-1-git-send-email-sds@tycho.nsa.gov> Message-ID: References: <1489166058-11789-1-git-send-email-sds@tycho.nsa.gov> User-Agent: Alpine 2.20 (LRH 67 2015-01-07) MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 543 Lines: 18 On Fri, 10 Mar 2017, Stephen Smalley wrote: > generic_permission() presently checks CAP_DAC_OVERRIDE prior to > CAP_DAC_READ_SEARCH. This can cause misleading audit messages when > using a LSM such as SELinux or AppArmor, since CAP_DAC_OVERRIDE > may not be required for the operation. Flip the order of the > tests so that CAP_DAC_OVERRIDE is only checked when required for > the operation. > > Signed-off-by: Stephen Smalley Acked-by: James Morris -- James Morris