Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752566AbdFTVk2 (ORCPT ); Tue, 20 Jun 2017 17:40:28 -0400 Received: from mail-pf0-f175.google.com ([209.85.192.175]:36046 "EHLO mail-pf0-f175.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752002AbdFTVk0 (ORCPT ); Tue, 20 Jun 2017 17:40:26 -0400 Date: Tue, 20 Jun 2017 14:40:24 -0700 From: Kees Cook To: Alexander Viro Cc: Solar Designer , "Serge E. Hallyn" , Andy Lutomirski , linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH] fs: Reorder inode_owner_or_capable() to avoid needless Message-ID: <20170620214024.GA121654@beast> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1422 Lines: 46 Checking for capabilities should be the last operation when performing access control tests so that PF_SUPERPRIV is set only when it was required for success (implying that the capability was needed for the operation). Reported-by: Solar Designer Cc: Serge E. Hallyn Cc: Andy Lutomirski Signed-off-by: Kees Cook --- fs/inode.c | 2 +- fs/namei.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/fs/inode.c b/fs/inode.c index db5914783a71..7092debe90cc 100644 --- a/fs/inode.c +++ b/fs/inode.c @@ -2023,7 +2023,7 @@ bool inode_owner_or_capable(const struct inode *inode) return true; ns = current_user_ns(); - if (ns_capable(ns, CAP_FOWNER) && kuid_has_mapping(ns, inode->i_uid)) + if (kuid_has_mapping(ns, inode->i_uid) && ns_capable(ns, CAP_FOWNER)) return true; return false; } diff --git a/fs/namei.c b/fs/namei.c index 6571a5f5112e..efe53a5d0737 100644 --- a/fs/namei.c +++ b/fs/namei.c @@ -1008,7 +1008,7 @@ static int may_linkat(struct path *link) /* Source inode owner (or CAP_FOWNER) can hardlink all they like, * otherwise, it must be a safe source. */ - if (inode_owner_or_capable(inode) || safe_hardlink_source(inode)) + if (safe_hardlink_source(inode) || inode_owner_or_capable(inode)) return 0; audit_log_link_denied("linkat", link); -- 2.7.4 -- Kees Cook Pixel Security