Re: [PATCH] Yama: turn process ancestry check into function

["Serge E. Hallyn" <serge@hallyn.com>]

Quoting Kees Cook (kees.cook@canonical.com):
> On Wed, Jul 14, 2010 at 09:19:09AM +0900, Tetsuo Handa wrote:
> > > +	if (mode == PTRACE_MODE_ATTACH &&
> > > +	    ptrace_scope &&
> > > +	    !task_is_descendant(current, child) &&
> > > +	    !capable(CAP_SYS_PTRACE))
> > > +		rc = -EPERM;
> > 
> > I don't know how heavy capable(CAP_SYS_PTRACE) is.
> > But checking !capable(CAP_SYS_PTRACE) before
> > !task_is_descendant(current, child) might be lighter.
> 
> That's the order I had before, but in looking at some of the other code, it
> seemed like moving it to the end made more logical sense.  Since checking
> PTRACE attach isn't a common or time-sensitive operation, I figured trying
> to tune it wasn't critical.

Yes the reason to keep it like this is that capable(CAP_SYS_PTRACE)
will set PF_SUPERPRIV if it passes.  You don't want to do that unless
the capability was actually required.

-serge