lkml.org 
[lkml]   [2008]   [Sep]   [26]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5/6] file capabilities: remove needless inline functions
    Date
    cap_limit_ptraced_target always returns 1, so nix it.

    cap_block_setpcap can't return 1 any more, because
    kernel/capabilities.c:sys_capset() will return -EPERM
    if it is called on a task other than current, and will
    never get to cap_capset_check.

    This brings the vmlinux size with my config down another
    16 bytes (making up for the 8 byte increase from the
    last patch).

    Signed-off-by: Serge E. Hallyn <serue@us.ibm.com>
    ---
    security/commoncap.c | 22 +++-------------------
    1 files changed, 3 insertions(+), 19 deletions(-)

    diff --git a/security/commoncap.c b/security/commoncap.c
    index d48fdd8..e5afb7c 100644
    --- a/security/commoncap.c
    +++ b/security/commoncap.c
    @@ -93,15 +93,6 @@ int cap_capget (struct task_struct *target, kernel_cap_t *effective,
    return 0;
    }

    -static inline int cap_block_setpcap(struct task_struct *target)
    -{
    - /*
    - * No support for remote process capability manipulation with
    - * filesystem capability support.
    - */
    - return (target != current);
    -}
    -
    static inline int cap_inh_is_capped(void)
    {
    /*
    @@ -112,14 +103,9 @@ static inline int cap_inh_is_capped(void)
    return (cap_capable(current, CAP_SETPCAP) != 0);
    }

    -static inline int cap_limit_ptraced_target(void) { return 1; }
    -
    int cap_capset_check (struct task_struct *target, kernel_cap_t *effective,
    kernel_cap_t *inheritable, kernel_cap_t *permitted)
    {
    - if (cap_block_setpcap(target)) {
    - return -EPERM;
    - }
    if (cap_inh_is_capped()
    && !cap_issubset(*inheritable,
    cap_combine(target->cap_inheritable,
    @@ -343,11 +329,9 @@ void cap_bprm_apply_creds (struct linux_binprm *bprm, int unsafe)
    bprm->e_uid = current->uid;
    bprm->e_gid = current->gid;
    }
    - if (cap_limit_ptraced_target()) {
    - bprm->cap_post_exec_permitted = cap_intersect(
    - bprm->cap_post_exec_permitted,
    - current->cap_permitted);
    - }
    + bprm->cap_post_exec_permitted = cap_intersect(
    + bprm->cap_post_exec_permitted,
    + current->cap_permitted);
    }
    }

    --
    1.5.1.1.GIT


    \
     
     \ /
      Last update: 2008-09-27 04:33    [W:0.021 / U:0.308 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site