From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id DDAF1C433F5 for ; Thu, 17 Feb 2022 17:30:10 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243719AbiBQRaX (ORCPT ); Thu, 17 Feb 2022 12:30:23 -0500 Received: from mxb-00190b01.gslb.pphosted.com ([23.128.96.19]:34386 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232550AbiBQRaV (ORCPT ); Thu, 17 Feb 2022 12:30:21 -0500 Received: from mail-pf1-x429.google.com (mail-pf1-x429.google.com [IPv6:2607:f8b0:4864:20::429]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 54ECD272D8F; Thu, 17 Feb 2022 09:30:06 -0800 (PST) Received: by mail-pf1-x429.google.com with SMTP id y11so251228pfa.6; Thu, 17 Feb 2022 09:30:06 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc:content-transfer-encoding; bh=S0mP+gQItL0EexL5aPknfQRXrpjtE7gE4U7C9cJtgV0=; b=Kz/FLUFB0NDlTmKj99fKKrcnTQeB/fx9Uqw/jTCu6dHipjcBAFoLfekUWSdzw4Hlui CIfb35ZI/EwZc2w1inhb02y4CQmXICjByqCDQ2BPY44irZEmjAnMtl3PWbfi8VQoVeYW NNLg6pvOxgWyAJbwxhYDOXyVikHxZj++z4AslfVm9w/r1swFlA72K1beNxhQd9MxeUNr qWTks3mHfsqk3XVu625gH7iVX2+ueUNpqoR1jinzv9zi69TqHYBbrfdNz8EMwaF8wl/v 3xupzVGdpvX0kikiXxrfSgYXS5obqL3a9/UCQF33LpHpSfZ7Ev78EK2brmSlLMVF6mz6 ZOww== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc:content-transfer-encoding; bh=S0mP+gQItL0EexL5aPknfQRXrpjtE7gE4U7C9cJtgV0=; b=fayBswHwBkUvy+Ywk9aRXWjUYyq7veoLKX4xn6vIJ72gin5bkdLumm0HOMrovzG0R+ qCr9Lkqk/Py6VzoylKX9+uS9AYr+9Y024cZ49DxSTqW47ga8EdaFdC1FR/JhUMifMzok 2Huk5tb3ruOjS8REWvSo/wxX3BZlHBSi/7HQ8zYWNaGi8qS9ymxHgJtJWoIvnhyKzozJ GNZxHkUx0mX28YiDG9ILfcEIsKOsCA8p7lIypg7s7tjw0UkF5gd/eLdvqLbrn0bzqrpi tPnN73oyrhRElV3Xzz6ov27LZ9viGzyyH5JwozP8BT3CfvftomlBvTHryZeRK+5MBza+ QvQQ== X-Gm-Message-State: AOAM533TA2fklPpHkv8SlpBiEeZf8F0wj/y8V8x1wnvqNFwAaJb0bKqM 8qT7bDbFGZB/tE1IDTu0utsyfRVTNsZ8sr1LWP4= X-Google-Smtp-Source: ABdhPJyN1tP+rIxNtkLNTBcv8VhNYwdGPrE+6Ix9rpxGp0PA6bghC6wpL1IbAlkx+BCS5PTp2fOUYtendkuCPisvovw= X-Received: by 2002:a63:f711:0:b0:373:585d:2fd4 with SMTP id x17-20020a63f711000000b00373585d2fd4mr3184332pgh.287.1645119005789; Thu, 17 Feb 2022 09:30:05 -0800 (PST) MIME-Version: 1.0 References: <20220217145003.78982-1-cgzones@googlemail.com> In-Reply-To: <20220217145003.78982-1-cgzones@googlemail.com> From: Alexei Starovoitov Date: Thu, 17 Feb 2022 09:29:54 -0800 Message-ID: Subject: Re: [RFC PATCH 2/2] capability: use new capable_or functionality To: =?UTF-8?Q?Christian_G=C3=B6ttsche?= Cc: selinux@vger.kernel.org, Jens Axboe , Hans Verkuil , Mauro Carvalho Chehab , "David S. Miller" , Jakub Kicinski , Stefan Haberland , Jan Hoeppner , Heiko Carstens , Vasily Gorbik , Christian Borntraeger , Alexander Gordeev , Sven Schnelle , Alexander Viro , Serge Hallyn , Alexei Starovoitov , Daniel Borkmann , Andrii Nakryiko , Martin KaFai Lau , Song Liu , Yonghong Song , John Fastabend , KP Singh , Zhen Lei , Arnd Bergmann , Laurent Pinchart , Julia Lawall , Greg Kroah-Hartman , Jiri Slaby , Pavel Skripkin , Du Cheng , "Eric W. Biederman" , Andrew Morton , Peter Zijlstra , Alexey Gladkov , David Hildenbrand , Rolf Eike Beer , Christian Brauner , Cyrill Gorcunov , Peter Collingbourne , Colin Cross , Davidlohr Bueso , Xiaofeng Cao , Nikolay Aleksandrov , Stefano Garzarella , Florian Fainelli , Ziyang Xuan , Alexander Aring , Eric Dumazet , Alistair Delva , Bart Van Assche , linux-block@vger.kernel.org, LKML , linux-media@vger.kernel.org, Network Development , linux-s390 , Linux-Fsdevel , LSM List , bpf Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-fsdevel@vger.kernel.org On Thu, Feb 17, 2022 at 6:50 AM Christian G=C3=B6ttsche wrote: > > Use the new added capable_or macro in appropriate cases, where a task > is required to have any of two capabilities. > > Reorder CAP_SYS_ADMIN last. > > TODO: split into subsystem patches. Yes. Please. The bpf side picked the existing order because we were aware of that selinux issue. Looks like there is no good order that works for all. So the new helper makes a lot of sense. > Fixes: 94c4b4fd25e6 ("block: Check ADMIN before NICE for IOPRIO_CLASS_RT"= )