* [PATCH] f2fs: avoid selinux denial on CAP_SYS_RESOURCE @ 2018-03-09 4:49 Jaegeuk Kim 2018-03-09 6:22 ` Chao Yu 0 siblings, 1 reply; 4+ messages in thread From: Jaegeuk Kim @ 2018-03-09 4:49 UTC (permalink / raw) To: linux-kernel, linux-f2fs-devel; +Cc: Jaegeuk Kim This fixes CAP_SYS_RESOURCE denial of selinux when using resgid. Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org> --- fs/f2fs/f2fs.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h index f6dc70666ebb..3d12277fbe9e 100644 --- a/fs/f2fs/f2fs.h +++ b/fs/f2fs/f2fs.h @@ -1607,13 +1607,13 @@ static inline bool __allow_reserved_blocks(struct f2fs_sb_info *sbi, return false; if (IS_NOQUOTA(inode)) return true; - if (capable(CAP_SYS_RESOURCE)) - return true; if (uid_eq(sbi->s_resuid, current_fsuid())) return true; if (!gid_eq(sbi->s_resgid, GLOBAL_ROOT_GID) && in_group_p(sbi->s_resgid)) return true; + if (capable(CAP_SYS_RESOURCE)) + return true; return false; } -- 2.15.0.531.g2ccb3012c9-goog ^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH] f2fs: avoid selinux denial on CAP_SYS_RESOURCE 2018-03-09 4:49 [PATCH] f2fs: avoid selinux denial on CAP_SYS_RESOURCE Jaegeuk Kim @ 2018-03-09 6:22 ` Chao Yu 2018-03-09 21:57 ` Jaegeuk Kim 0 siblings, 1 reply; 4+ messages in thread From: Chao Yu @ 2018-03-09 6:22 UTC (permalink / raw) To: Jaegeuk Kim, linux-kernel, linux-f2fs-devel On 2018/3/9 12:49, Jaegeuk Kim wrote: > This fixes CAP_SYS_RESOURCE denial of selinux when using resgid. A little confusion, if capable(CAP_SYS_RESOURCE) is false, we still have chance to return true for below resuid & resgid cases, right? Thanks, > > Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org> > --- > fs/f2fs/f2fs.h | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) > > diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h > index f6dc70666ebb..3d12277fbe9e 100644 > --- a/fs/f2fs/f2fs.h > +++ b/fs/f2fs/f2fs.h > @@ -1607,13 +1607,13 @@ static inline bool __allow_reserved_blocks(struct f2fs_sb_info *sbi, > return false; > if (IS_NOQUOTA(inode)) > return true; > - if (capable(CAP_SYS_RESOURCE)) > - return true; > if (uid_eq(sbi->s_resuid, current_fsuid())) > return true; > if (!gid_eq(sbi->s_resgid, GLOBAL_ROOT_GID) && > in_group_p(sbi->s_resgid)) > return true; > + if (capable(CAP_SYS_RESOURCE)) > + return true; > return false; > } > > ^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] f2fs: avoid selinux denial on CAP_SYS_RESOURCE 2018-03-09 6:22 ` Chao Yu @ 2018-03-09 21:57 ` Jaegeuk Kim 2018-03-14 13:07 ` [f2fs-dev] " Chao Yu 0 siblings, 1 reply; 4+ messages in thread From: Jaegeuk Kim @ 2018-03-09 21:57 UTC (permalink / raw) To: Chao Yu; +Cc: linux-kernel, linux-f2fs-devel On 03/09, Chao Yu wrote: > On 2018/3/9 12:49, Jaegeuk Kim wrote: > > This fixes CAP_SYS_RESOURCE denial of selinux when using resgid. > > A little confusion, if capable(CAP_SYS_RESOURCE) is false, we still have chance > to return true for below resuid & resgid cases, right? I didn't dig it deeply tho, it seems selinux log came up when capable() is failed in the first place. We actually didn't need to show it up, since next resgid will give mostly true. > > Thanks, > > > > > Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org> > > --- > > fs/f2fs/f2fs.h | 4 ++-- > > 1 file changed, 2 insertions(+), 2 deletions(-) > > > > diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h > > index f6dc70666ebb..3d12277fbe9e 100644 > > --- a/fs/f2fs/f2fs.h > > +++ b/fs/f2fs/f2fs.h > > @@ -1607,13 +1607,13 @@ static inline bool __allow_reserved_blocks(struct f2fs_sb_info *sbi, > > return false; > > if (IS_NOQUOTA(inode)) > > return true; > > - if (capable(CAP_SYS_RESOURCE)) > > - return true; > > if (uid_eq(sbi->s_resuid, current_fsuid())) > > return true; > > if (!gid_eq(sbi->s_resgid, GLOBAL_ROOT_GID) && > > in_group_p(sbi->s_resgid)) > > return true; > > + if (capable(CAP_SYS_RESOURCE)) > > + return true; > > return false; > > } > > > > ^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [f2fs-dev] [PATCH] f2fs: avoid selinux denial on CAP_SYS_RESOURCE 2018-03-09 21:57 ` Jaegeuk Kim @ 2018-03-14 13:07 ` Chao Yu 0 siblings, 0 replies; 4+ messages in thread From: Chao Yu @ 2018-03-14 13:07 UTC (permalink / raw) To: Jaegeuk Kim, Chao Yu; +Cc: linux-kernel, linux-f2fs-devel On 2018/3/10 5:57, Jaegeuk Kim wrote: > On 03/09, Chao Yu wrote: >> On 2018/3/9 12:49, Jaegeuk Kim wrote: >>> This fixes CAP_SYS_RESOURCE denial of selinux when using resgid. >> >> A little confusion, if capable(CAP_SYS_RESOURCE) is false, we still have chance >> to return true for below resuid & resgid cases, right? > > I didn't dig it deeply tho, it seems selinux log came up when capable() is > failed in the first place. We actually didn't need to show it up, since next > resgid will give mostly true. Got it, how about adding this reason into commit message? Anyway, Reviewed-by: Chao Yu <yuchao0@huawei.com> Thanks, > >> >> Thanks, >> >>> >>> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org> >>> --- >>> fs/f2fs/f2fs.h | 4 ++-- >>> 1 file changed, 2 insertions(+), 2 deletions(-) >>> >>> diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h >>> index f6dc70666ebb..3d12277fbe9e 100644 >>> --- a/fs/f2fs/f2fs.h >>> +++ b/fs/f2fs/f2fs.h >>> @@ -1607,13 +1607,13 @@ static inline bool __allow_reserved_blocks(struct f2fs_sb_info *sbi, >>> return false; >>> if (IS_NOQUOTA(inode)) >>> return true; >>> - if (capable(CAP_SYS_RESOURCE)) >>> - return true; >>> if (uid_eq(sbi->s_resuid, current_fsuid())) >>> return true; >>> if (!gid_eq(sbi->s_resgid, GLOBAL_ROOT_GID) && >>> in_group_p(sbi->s_resgid)) >>> return true; >>> + if (capable(CAP_SYS_RESOURCE)) >>> + return true; >>> return false; >>> } >>> >>> > > ------------------------------------------------------------------------------ > Check out the vibrant tech community on one of the world's most > engaging tech sites, Slashdot.org! http://sdm.link/slashdot > _______________________________________________ > Linux-f2fs-devel mailing list > Linux-f2fs-devel@lists.sourceforge.net > https://lists.sourceforge.net/lists/listinfo/linux-f2fs-devel > ^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2018-03-14 13:08 UTC | newest] Thread overview: 4+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2018-03-09 4:49 [PATCH] f2fs: avoid selinux denial on CAP_SYS_RESOURCE Jaegeuk Kim 2018-03-09 6:22 ` Chao Yu 2018-03-09 21:57 ` Jaegeuk Kim 2018-03-14 13:07 ` [f2fs-dev] " Chao Yu
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox