Commit 935d8aab authored by Linus Torvalds's avatar Linus Torvalds

Add file_ns_capable() helper function for open-time capability checking

Nothing is using it yet, but this will allow us to delay the open-time
checks to use time, without breaking the normal UNIX permission
semantics where permissions are determined by the opener (and the file
descriptor can then be passed to a different process, or the process can
drop capabilities).
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent 5b55d708
...@@ -35,6 +35,7 @@ struct cpu_vfs_cap_data { ...@@ -35,6 +35,7 @@ struct cpu_vfs_cap_data {
#define _KERNEL_CAP_T_SIZE (sizeof(kernel_cap_t)) #define _KERNEL_CAP_T_SIZE (sizeof(kernel_cap_t))
struct file;
struct inode; struct inode;
struct dentry; struct dentry;
struct user_namespace; struct user_namespace;
...@@ -211,6 +212,7 @@ extern bool capable(int cap); ...@@ -211,6 +212,7 @@ extern bool capable(int cap);
extern bool ns_capable(struct user_namespace *ns, int cap); extern bool ns_capable(struct user_namespace *ns, int cap);
extern bool nsown_capable(int cap); extern bool nsown_capable(int cap);
extern bool inode_capable(const struct inode *inode, int cap); extern bool inode_capable(const struct inode *inode, int cap);
extern bool file_ns_capable(const struct file *file, struct user_namespace *ns, int cap);
/* audit system wants to get cap info from files as well */ /* audit system wants to get cap info from files as well */
extern int get_vfs_caps_from_disk(const struct dentry *dentry, struct cpu_vfs_cap_data *cpu_caps); extern int get_vfs_caps_from_disk(const struct dentry *dentry, struct cpu_vfs_cap_data *cpu_caps);
......
...@@ -392,6 +392,30 @@ bool ns_capable(struct user_namespace *ns, int cap) ...@@ -392,6 +392,30 @@ bool ns_capable(struct user_namespace *ns, int cap)
} }
EXPORT_SYMBOL(ns_capable); EXPORT_SYMBOL(ns_capable);
/**
* file_ns_capable - Determine if the file's opener had a capability in effect
* @file: The file we want to check
* @ns: The usernamespace we want the capability in
* @cap: The capability to be tested for
*
* Return true if task that opened the file had a capability in effect
* when the file was opened.
*
* This does not set PF_SUPERPRIV because the caller may not
* actually be privileged.
*/
bool file_ns_capable(const struct file *file, struct user_namespace *ns, int cap)
{
if (WARN_ON_ONCE(!cap_valid(cap)))
return false;
if (security_capable(file->f_cred, ns, cap) == 0)
return true;
return false;
}
EXPORT_SYMBOL(file_ns_capable);
/** /**
* capable - Determine if the current task has a superior capability in effect * capable - Determine if the current task has a superior capability in effect
* @cap: The capability to be tested for * @cap: The capability to be tested for
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment