Re: [PATCH 22/43] userns: Convert capabilities related permsion checks

Eric W. Biederman
2012-04-20T23:14:52Z

"Serge E. Hallyn" <serge@hallyn.com> writes:

> Quoting Eric W. Beiderman (ebiederm@xmission.com):
>> From: Eric W. Biederman <ebiederm@xmission.com>
>>
>> - Use uid_eq when comparing kuids
>> Use gid_eq when comparing kgids
>> - Use __make_kuid(user_ns, 0) to talk about the user_namespace root uid
>> Use __make_kgid(user_ns, 0) to talk about the user_namespace root gid
>>
>> Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>
>
> Acked-by: Serge Hallyn <serge.hallyn@canonical.com>
>
> though, nit,
>
>> ---
>> fs/open.c | 3 ++-
>> security/commoncap.c | 43 ++++++++++++++++++++++++++++---------------
>> 2 files changed, 30 insertions(+), 16 deletions(-)
>>

>> diff --git a/security/commoncap.c b/security/commoncap.c
>> index dbd465a..9bf8df8 100644
>> --- a/security/commoncap.c
>> +++ b/security/commoncap.c
>> @@ -472,19 +472,24 @@ int cap_bprm_set_creds(struct linux_binprm *bprm)
>> struct cred *new = bprm->cred;
>> bool effective, has_cap = false;
>> int ret;
>> + kuid_t root_uid;
>> + kgid_t root_gid;
>
> the root_gid is assigned but never used.

Thanks snipped. It doesn't look like there will ever be a use for it.

>>
>> effective = false;
>> ret = get_file_caps(bprm, &effective, &has_cap);
>> if (ret < 0)
>> return ret;
>>
>> + root_uid = make_kuid(new->user_ns, 0);
>> + root_gid = make_kgid(new->user_ns, 0);
>> +

Eric