lkml.org 
[lkml]   [2018]   [Mar]   [9]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [PATCH] f2fs: avoid selinux denial on CAP_SYS_RESOURCE
    On 03/09, Chao Yu wrote:
    > On 2018/3/9 12:49, Jaegeuk Kim wrote:
    > > This fixes CAP_SYS_RESOURCE denial of selinux when using resgid.
    >
    > A little confusion, if capable(CAP_SYS_RESOURCE) is false, we still have chance
    > to return true for below resuid & resgid cases, right?

    I didn't dig it deeply tho, it seems selinux log came up when capable() is
    failed in the first place. We actually didn't need to show it up, since next
    resgid will give mostly true.

    >
    > Thanks,
    >
    > >
    > > Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
    > > ---
    > > fs/f2fs/f2fs.h | 4 ++--
    > > 1 file changed, 2 insertions(+), 2 deletions(-)
    > >
    > > diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h
    > > index f6dc70666ebb..3d12277fbe9e 100644
    > > --- a/fs/f2fs/f2fs.h
    > > +++ b/fs/f2fs/f2fs.h
    > > @@ -1607,13 +1607,13 @@ static inline bool __allow_reserved_blocks(struct f2fs_sb_info *sbi,
    > > return false;
    > > if (IS_NOQUOTA(inode))
    > > return true;
    > > - if (capable(CAP_SYS_RESOURCE))
    > > - return true;
    > > if (uid_eq(sbi->s_resuid, current_fsuid()))
    > > return true;
    > > if (!gid_eq(sbi->s_resgid, GLOBAL_ROOT_GID) &&
    > > in_group_p(sbi->s_resgid))
    > > return true;
    > > + if (capable(CAP_SYS_RESOURCE))
    > > + return true;
    > > return false;
    > > }
    > >
    > >

    \
     
     \ /
      Last update: 2018-03-09 22:58    [W:2.459 / U:0.256 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site