capabilities: remove a layer of conditional logic
Remove a layer of conditional logic to make the use of conditions easier to read and analyse. Signed-off-by: Richard Guy Briggs <rgb@redhat.com> Reviewed-by: Serge Hallyn <serge@hallyn.com> Acked-by: James Morris <james.l.morris@oracle.com> Acked-by: Kees Cook <keescook@chromium.org> Okay-ished-by: Paul Moore <paul@paul-moore.com> Signed-off-by: James Morris <james.l.morris@oracle.com>
This commit is contained in:
parent
9fbc2c7964
commit
02ebbaf48c
|
@ -781,13 +781,12 @@ static inline bool nonroot_raised_pE(struct cred *cred, kuid_t root)
|
||||||
{
|
{
|
||||||
bool ret = false;
|
bool ret = false;
|
||||||
|
|
||||||
if (__cap_grew(effective, ambient, cred)) {
|
if (__cap_grew(effective, ambient, cred) &&
|
||||||
if (!__cap_full(effective, cred) ||
|
(!__cap_full(effective, cred) ||
|
||||||
!__is_eff(root, cred) || !__is_real(root, cred) ||
|
!__is_eff(root, cred) ||
|
||||||
!root_privileged()) {
|
!__is_real(root, cred) ||
|
||||||
ret = true;
|
!root_privileged()))
|
||||||
}
|
ret = true;
|
||||||
}
|
|
||||||
return ret;
|
return ret;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -880,13 +879,11 @@ int cap_bprm_set_creds(struct linux_binprm *bprm)
|
||||||
|
|
||||||
/* Check for privilege-elevated exec. */
|
/* Check for privilege-elevated exec. */
|
||||||
bprm->cap_elevated = 0;
|
bprm->cap_elevated = 0;
|
||||||
if (is_setid) {
|
if (is_setid ||
|
||||||
|
(!__is_real(root_uid, new) &&
|
||||||
|
(effective ||
|
||||||
|
__cap_grew(permitted, ambient, new))))
|
||||||
bprm->cap_elevated = 1;
|
bprm->cap_elevated = 1;
|
||||||
} else if (!__is_real(root_uid, new)) {
|
|
||||||
if (effective ||
|
|
||||||
__cap_grew(permitted, ambient, new))
|
|
||||||
bprm->cap_elevated = 1;
|
|
||||||
}
|
|
||||||
|
|
||||||
return 0;
|
return 0;
|
||||||
}
|
}
|
||||||
|
|
Loading…
Reference in a new issue