Kernel/linux
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2025-01-09 14:50:19 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

capabilites: introduce new has_ns_capabilities_noaudit

Browse Source 
For consistency in interfaces, introduce a new interface called
has_ns_capabilities_noaudit.  It checks if the given task has the given
capability in the given namespace.  Use this new function by
has_capabilities_noaudit.

Signed-off-by: Eric Paris <eparis@redhat.com>
Acked-by: Serge E. Hallyn <serge.hallyn@canonical.com>
This commit is contained in:
Eric Paris 2012-01-03 12:25:15 -05:00
parent 25e7570341
commit 7b61d64849
2 changed files with 30 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
include/linux/capability.h
View File

@ -543,6 +543,8 @@ extern bool has_capability(struct task_struct *t, int cap);
extern bool has_ns_capability(struct task_struct *t, extern bool has_ns_capability(struct task_struct *t,
struct user_namespace *ns, int cap); struct user_namespace *ns, int cap);
extern bool has_capability_noaudit(struct task_struct *t, int cap); extern bool has_capability_noaudit(struct task_struct *t, int cap);
extern bool has_ns_capability_noaudit(struct task_struct *t,
struct user_namespace *ns, int cap);
extern bool capable(int cap); extern bool capable(int cap);
extern bool ns_capable(struct user_namespace *ns, int cap); extern bool ns_capable(struct user_namespace *ns, int cap);
extern bool task_ns_capable(struct task_struct *t, int cap); extern bool task_ns_capable(struct task_struct *t, int cap);

36
kernel/capability.c
View File

@ -325,7 +325,33 @@ bool has_capability(struct task_struct *t, int cap)
} }
/** /**
* has_capability_noaudit - Does a task have a capability (unaudited) * has_ns_capability_noaudit - Does a task have a capability (unaudited)
* in a specific user ns.
* @t: The task in question
* @ns: target user namespace
* @cap: The capability to be tested for
*
* Return true if the specified task has the given superior capability
* currently in effect to the specified user namespace, false if not.
* Do not write an audit message for the check.
*
* Note that this does not set PF_SUPERPRIV on the task.
*/
bool has_ns_capability_noaudit(struct task_struct *t,
struct user_namespace *ns, int cap)
{
int ret;
rcu_read_lock();
ret = security_capable_noaudit(__task_cred(t), ns, cap);
rcu_read_unlock();
return (ret == 0);
}
/**
* has_capability_noaudit - Does a task have a capability (unaudited) in the
* initial user ns
* @t: The task in question * @t: The task in question
* @cap: The capability to be tested for * @cap: The capability to be tested for
* *
@ -337,13 +363,7 @@ bool has_capability(struct task_struct *t, int cap)
*/ */
bool has_capability_noaudit(struct task_struct *t, int cap) bool has_capability_noaudit(struct task_struct *t, int cap)
{ {
int ret; return has_ns_capability_noaudit(t, &init_user_ns, cap);
rcu_read_lock();
ret = security_capable_noaudit(__task_cred(t), &init_user_ns, cap);
rcu_read_unlock();
return (ret == 0);
} }
/** /**