capabilities: remove a layer of conditional logic
Remove a layer of conditional logic to make the use of conditions easier to read and analyse. Signed-off-by: Richard Guy Briggs <rgb@redhat.com> Reviewed-by: Serge Hallyn <serge@hallyn.com> Acked-by: James Morris <james.l.morris@oracle.com> Acked-by: Kees Cook <keescook@chromium.org> Okay-ished-by: Paul Moore <paul@paul-moore.com> Signed-off-by: James Morris <james.l.morris@oracle.com>
This commit is contained in:
parent
9fbc2c7964
commit
02ebbaf48c
|
@ -781,13 +781,12 @@ static inline bool nonroot_raised_pE(struct cred *cred, kuid_t root)
|
|||
{
|
||||
bool ret = false;
|
||||
|
||||
if (__cap_grew(effective, ambient, cred)) {
|
||||
if (!__cap_full(effective, cred) ||
|
||||
!__is_eff(root, cred) || !__is_real(root, cred) ||
|
||||
!root_privileged()) {
|
||||
ret = true;
|
||||
}
|
||||
}
|
||||
if (__cap_grew(effective, ambient, cred) &&
|
||||
(!__cap_full(effective, cred) ||
|
||||
!__is_eff(root, cred) ||
|
||||
!__is_real(root, cred) ||
|
||||
!root_privileged()))
|
||||
ret = true;
|
||||
return ret;
|
||||
}
|
||||
|
||||
|
@ -880,13 +879,11 @@ int cap_bprm_set_creds(struct linux_binprm *bprm)
|
|||
|
||||
/* Check for privilege-elevated exec. */
|
||||
bprm->cap_elevated = 0;
|
||||
if (is_setid) {
|
||||
if (is_setid ||
|
||||
(!__is_real(root_uid, new) &&
|
||||
(effective ||
|
||||
__cap_grew(permitted, ambient, new))))
|
||||
bprm->cap_elevated = 1;
|
||||
} else if (!__is_real(root_uid, new)) {
|
||||
if (effective ||
|
||||
__cap_grew(permitted, ambient, new))
|
||||
bprm->cap_elevated = 1;
|
||||
}
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
|
Loading…
Reference in a new issue