Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1598061

Re: [PATCH] fs: switch order of CAP_DAC_OVERRIDE and CAP_DAC_READ_SEARCH checks

Show all headers | View raw

On Fri, Mar 10, 2017 at 12:14 PM, Stephen Smalley <sds@tycho.nsa.gov> wrote:
> generic_permission() presently checks CAP_DAC_OVERRIDE prior to
> CAP_DAC_READ_SEARCH.  This can cause misleading audit messages when
> using a LSM such as SELinux or AppArmor, since CAP_DAC_OVERRIDE
> may not be required for the operation.  Flip the order of the
> tests so that CAP_DAC_OVERRIDE is only checked when required for
> the operation.
>
> Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
> ---
>  fs/namei.c | 20 ++++++++++----------
>  1 file changed, 10 insertions(+), 10 deletions(-)

This is the second posting of this patch and so far no comment ... if
I don't see any negative responses by next week I'll go ahead and
merge this into the selinux/next tree.

> diff --git a/fs/namei.c b/fs/namei.c
> index d41fab7..482414a 100644
> --- a/fs/namei.c
> +++ b/fs/namei.c
> @@ -340,22 +340,14 @@ int generic_permission(struct inode *inode, int mask)
>
>         if (S_ISDIR(inode->i_mode)) {
>                 /* DACs are overridable for directories */
> -               if (capable_wrt_inode_uidgid(inode, CAP_DAC_OVERRIDE))
> -                       return 0;
>                 if (!(mask & MAY_WRITE))
>                         if (capable_wrt_inode_uidgid(inode,
>                                                      CAP_DAC_READ_SEARCH))
>                                 return 0;
> -               return -EACCES;
> -       }
> -       /*
> -        * Read/write DACs are always overridable.
> -        * Executable DACs are overridable when there is
> -        * at least one exec bit set.
> -        */
> -       if (!(mask & MAY_EXEC) || (inode->i_mode & S_IXUGO))
>                 if (capable_wrt_inode_uidgid(inode, CAP_DAC_OVERRIDE))
>                         return 0;
> +               return -EACCES;
> +       }
>
>         /*
>          * Searching includes executable on directories, else just read.
> @@ -364,6 +356,14 @@ int generic_permission(struct inode *inode, int mask)
>         if (mask == MAY_READ)
>                 if (capable_wrt_inode_uidgid(inode, CAP_DAC_READ_SEARCH))
>                         return 0;
> +       /*
> +        * Read/write DACs are always overridable.
> +        * Executable DACs are overridable when there is
> +        * at least one exec bit set.
> +        */
> +       if (!(mask & MAY_EXEC) || (inode->i_mode & S_IXUGO))
> +               if (capable_wrt_inode_uidgid(inode, CAP_DAC_OVERRIDE))
> +                       return 0;
>
>         return -EACCES;
>  }
> --
> 2.7.4
>



-- 
paul moore
www.paul-moore.com

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH] fs: switch order of CAP_DAC_OVERRIDE and CAP_DAC_READ_SEARCH checks Stephen Smalley <sds@tycho.nsa.gov> - 2017-03-10 18:20 +0100
  Re: [PATCH] fs: switch order of CAP_DAC_OVERRIDE and  CAP_DAC_READ_SEARCH checks Paul Moore <paul@paul-moore.com> - 2017-03-10 21:00 +0100
    Re: [PATCH] fs: switch order of CAP_DAC_OVERRIDE and  CAP_DAC_READ_SEARCH checks John Johansen <john.johansen@canonical.com> - 2017-03-10 22:20 +0100
  Re: [PATCH] fs: switch order of CAP_DAC_OVERRIDE and  CAP_DAC_READ_SEARCH checks "Serge E. Hallyn" <serge@hallyn.com> - 2017-03-10 23:00 +0100
  Re: [PATCH] fs: switch order of CAP_DAC_OVERRIDE and CAP_DAC_READ_SEARCH  checks James Morris <jmorris@namei.org> - 2017-03-11 02:10 +0100

csiph-web