github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-05-29 17:43:52 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

Clarify the rootid_owns_currentns

Browse Source 
Split most of the rootid_owns_currentns() functionality
into a more generic rootid_owns_ns() function which
will be easier to write tests for.

Rename the functions and variables to make clear that
the ids being tested could be any uid.

Signed-off-by: Serge Hallyn <serge@hallyn.com>
CC: Ryan Foster <foster.ryan.r@gmail.com>
CC: Christian Brauner <brauner@kernel.org>

---
v2: change the function parameter documentation to mollify the bot.
This commit is contained in:
Serge Hallyn 2025-11-14 04:32:36 +00:00 committed by Serge Hallyn
parent 211ddde082
commit 9891d2f79a
No known key found for this signature in database
GPG Key ID: 3570DA17270ACE24
1 changed files with 22 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

34
security/commoncap.c
View File

@ -358,17 +358,17 @@ int cap_inode_killpriv(struct mnt_idmap *idmap, struct dentry *dentry)
return error; return error;
} }
static bool rootid_owns_currentns(vfsuid_t rootvfsuid) /**
* kuid_root_in_ns - check whether the given kuid is root in the given ns
* @kuid: the kuid to be tested
* @ns: the user namespace to test against
*
* Returns true if @kuid represents the root user in @ns, false otherwise.
*/
static bool kuid_root_in_ns(kuid_t kuid, struct user_namespace *ns)
{ {
struct user_namespace *ns; for (;; ns = ns->parent) {
kuid_t kroot; if (from_kuid(ns, kuid) == 0)
if (!vfsuid_valid(rootvfsuid))
return false;
kroot = vfsuid_into_kuid(rootvfsuid);
for (ns = current_user_ns();; ns = ns->parent) {
if (from_kuid(ns, kroot) == 0)
return true; return true;
if (ns == &init_user_ns) if (ns == &init_user_ns)
break; break;
@ -377,6 +377,16 @@ static bool rootid_owns_currentns(vfsuid_t rootvfsuid)
return false; return false;
} }
static bool vfsuid_root_in_currentns(vfsuid_t vfsuid)
{
kuid_t kuid;
if (!vfsuid_valid(vfsuid))
return false;
kuid = vfsuid_into_kuid(vfsuid);
return kuid_root_in_ns(kuid, current_user_ns());
}
static __u32 sansflags(__u32 m) static __u32 sansflags(__u32 m)
{ {
return m & ~VFS_CAP_FLAGS_EFFECTIVE; return m & ~VFS_CAP_FLAGS_EFFECTIVE;
@ -481,7 +491,7 @@ int cap_inode_getsecurity(struct mnt_idmap *idmap,
goto out_free; goto out_free;
} }
if (!rootid_owns_currentns(vfsroot)) { if (!vfsuid_root_in_currentns(vfsroot)) {
size = -EOVERFLOW; size = -EOVERFLOW;
goto out_free; goto out_free;
} }
@ -722,7 +732,7 @@ int get_vfs_caps_from_disk(struct mnt_idmap *idmap,
/* Limit the caps to the mounter of the filesystem /* Limit the caps to the mounter of the filesystem
* or the more limited uid specified in the xattr. * or the more limited uid specified in the xattr.
*/ */
if (!rootid_owns_currentns(rootvfsuid)) if (!vfsuid_root_in_currentns(rootvfsuid))
return -ENODATA; return -ENODATA;
cpu_caps->permitted.val = le32_to_cpu(caps->data[0].permitted); cpu_caps->permitted.val = le32_to_cpu(caps->data[0].permitted);