inode_capable(_nolog) -> capable_wrt_inode_uidgid.

apply changes from mainline to grsecurity nolog functions.

diff --git a/fs/namei.c b/fs/namei.c
index 711664aba32172191af8b0c68636eb57b87b8671..a65ea711c2255a1988f3c2d5c908d409320ff30f 100644 (file)
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -333,7 +333,7 @@ int generic_permission(struct inode *inode, int mask)
                        if (capable_wrt_inode_uidgid(inode,
                                                     CAP_DAC_READ_SEARCH))
                                return 0;
-               if (inode_capable(inode, CAP_DAC_OVERRIDE))
+               if (capable_wrt_inode_uidgid(inode, CAP_DAC_OVERRIDE))
                        return 0;
                return -EACCES;
        }
@@ -342,8 +342,8 @@ int generic_permission(struct inode *inode, int mask)
         */
        mask &= MAY_READ | MAY_WRITE | MAY_EXEC;
        if (mask == MAY_READ)
-               if (inode_capable_nolog(inode, CAP_DAC_OVERRIDE) ||
-                   inode_capable(inode, CAP_DAC_READ_SEARCH))
+               if (capable_wrt_inode_uidgid_nolog(inode, CAP_DAC_OVERRIDE) ||
+                   capable_wrt_inode_uidgid(inode, CAP_DAC_READ_SEARCH))
                        return 0;
 
        /*

diff --git a/include/linux/capability.h b/include/linux/capability.h
index bc7ebb902c2888a6eb3ea295417495c4b1c77068..d52b825da920a5784b183688c1baf4ae615b3326 100644 (file)
--- a/include/linux/capability.h
+++ b/include/linux/capability.h
@@ -215,7 +215,7 @@ extern bool capable_wrt_inode_uidgid(const struct inode *inode, int cap);
 extern bool file_ns_capable(const struct file *file, struct user_namespace *ns, int cap);
 extern bool capable_nolog(int cap);
 extern bool ns_capable_nolog(struct user_namespace *ns, int cap);
-extern bool inode_capable_nolog(const struct inode *inode, int cap);
+extern bool capable_wrt_inode_uidgid_nolog(const struct inode *inode, int cap);
 
 /* audit system wants to get cap info from files as well */
 extern int get_vfs_caps_from_disk(const struct dentry *dentry, struct cpu_vfs_cap_data *cpu_caps);

diff --git a/kernel/capability.c b/kernel/capability.c
index 3d9fe6211a94c35652e433c21160fc779ab8b0dc..2881809bb2badd5d613cc4cef534fe358a701635 100644 (file)
--- a/kernel/capability.c
+++ b/kernel/capability.c
@@ -486,9 +486,10 @@ bool capable_wrt_inode_uidgid(const struct inode *inode, int cap)
                kgid_has_mapping(ns, inode->i_gid);
 }
 
-bool inode_capable_nolog(const struct inode *inode, int cap)
+bool capable_wrt_inode_uidgid_nolog(const struct inode *inode, int cap)
 {
        struct user_namespace *ns = current_user_ns();
 
-       return ns_capable_nolog(ns, cap) && kuid_has_mapping(ns, inode->i_uid);
+       return ns_capable_nolog(ns, cap) && kuid_has_mapping(ns, inode->i_uid) &&
+               kgid_has_mapping(ns, inode->i_gid);
 }