All of lore.kernel.org
 help / color / mirror / Atom feed
From: "Christian Göttsche" <cgzones@googlemail.com>
To: selinux@vger.kernel.org
Cc: Serge Hallyn <serge@hallyn.com>,
	"David S. Miller" <davem@davemloft.net>,
	Eric Dumazet <edumazet@google.com>,
	Jakub Kicinski <kuba@kernel.org>, Paolo Abeni <pabeni@redhat.com>,
	Alexander Aring <alex.aring@gmail.com>,
	Stefan Schmidt <stefan@datenfreihafen.org>,
	Hideaki YOSHIFUJI <yoshfuji@linux-ipv6.org>,
	David Ahern <dsahern@kernel.org>,
	Nikolay Aleksandrov <nikolay@nvidia.com>,
	Stefano Garzarella <sgarzare@redhat.com>,
	Oliver Hartkopp <socketcan@hartkopp.net>,
	Ziyang Xuan <william.xuanziyang@huawei.com>,
	Pavel Begunkov <asml.silence@gmail.com>,
	Wei Wang <weiwan@google.com>, Yangbo Lu <yangbo.lu@nxp.com>,
	Menglong Dong <imagedong@tencent.com>,
	Thomas Gleixner <tglx@linutronix.de>,
	Richard Palethorpe <rpalethorpe@suse.com>,
	linux-security-module@vger.kernel.org,
	linux-kernel@vger.kernel.org, netdev@vger.kernel.org,
	linux-wpan@vger.kernel.org
Subject: [PATCH v3 8/8] net: use new capable_any functionality
Date: Wed, 15 Jun 2022 17:26:22 +0200	[thread overview]
Message-ID: <20220615152623.311223-7-cgzones@googlemail.com> (raw)
In-Reply-To: <20220615152623.311223-1-cgzones@googlemail.com>

Use the new added capable_any function in appropriate cases, where a
task is required to have any of two capabilities.

Reorder CAP_SYS_ADMIN last.

Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
---
v3:
  - rename to capable_any()
  - make use of ns_capable_any
---
 net/caif/caif_socket.c   |  2 +-
 net/core/sock.c          | 12 ++++--------
 net/ieee802154/socket.c  |  6 ++----
 net/ipv4/ip_sockglue.c   |  3 +--
 net/ipv6/ipv6_sockglue.c |  3 +--
 net/unix/scm.c           |  2 +-
 6 files changed, 10 insertions(+), 18 deletions(-)

diff --git a/net/caif/caif_socket.c b/net/caif/caif_socket.c
index 251e666ba9a2..2d3df7658e04 100644
--- a/net/caif/caif_socket.c
+++ b/net/caif/caif_socket.c
@@ -1036,7 +1036,7 @@ static int caif_create(struct net *net, struct socket *sock, int protocol,
 		.usersize = sizeof_field(struct caifsock, conn_req.param)
 	};
 
-	if (!capable(CAP_SYS_ADMIN) && !capable(CAP_NET_ADMIN))
+	if (!capable_any(CAP_NET_ADMIN, CAP_SYS_ADMIN))
 		return -EPERM;
 	/*
 	 * The sock->type specifies the socket type to use.
diff --git a/net/core/sock.c b/net/core/sock.c
index 2ff40dd0a7a6..6b04301982d8 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -1163,8 +1163,7 @@ int sock_setsockopt(struct socket *sock, int level, int optname,
 
 	case SO_PRIORITY:
 		if ((val >= 0 && val <= 6) ||
-		    ns_capable(sock_net(sk)->user_ns, CAP_NET_RAW) ||
-		    ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN))
+		    ns_capable_any(sock_net(sk)->user_ns, CAP_NET_RAW, CAP_NET_ADMIN))
 			sk->sk_priority = val;
 		else
 			ret = -EPERM;
@@ -1309,8 +1308,7 @@ int sock_setsockopt(struct socket *sock, int level, int optname,
 			clear_bit(SOCK_PASSSEC, &sock->flags);
 		break;
 	case SO_MARK:
-		if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_RAW) &&
-		    !ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN)) {
+		if (!ns_capable_any(sock_net(sk)->user_ns, CAP_NET_RAW, CAP_NET_ADMIN)) {
 			ret = -EPERM;
 			break;
 		}
@@ -1318,8 +1316,7 @@ int sock_setsockopt(struct socket *sock, int level, int optname,
 		__sock_set_mark(sk, val);
 		break;
 	case SO_RCVMARK:
-		if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_RAW) &&
-		    !ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN)) {
+		if (!ns_capable_any(sock_net(sk)->user_ns, CAP_NET_RAW, CAP_NET_ADMIN)) {
 			ret = -EPERM;
 			break;
 		}
@@ -2680,8 +2677,7 @@ int __sock_cmsg_send(struct sock *sk, struct msghdr *msg, struct cmsghdr *cmsg,
 
 	switch (cmsg->cmsg_type) {
 	case SO_MARK:
-		if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_RAW) &&
-		    !ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN))
+		if (!ns_capable_any(sock_net(sk)->user_ns, CAP_NET_RAW, CAP_NET_ADMIN))
 			return -EPERM;
 		if (cmsg->cmsg_len != CMSG_LEN(sizeof(u32)))
 			return -EINVAL;
diff --git a/net/ieee802154/socket.c b/net/ieee802154/socket.c
index 718fb77bb372..882483602c27 100644
--- a/net/ieee802154/socket.c
+++ b/net/ieee802154/socket.c
@@ -894,8 +894,7 @@ static int dgram_setsockopt(struct sock *sk, int level, int optname,
 		ro->want_lqi = !!val;
 		break;
 	case WPAN_SECURITY:
-		if (!ns_capable(net->user_ns, CAP_NET_ADMIN) &&
-		    !ns_capable(net->user_ns, CAP_NET_RAW)) {
+		if (!ns_capable_any(net->user_ns, CAP_NET_RAW, CAP_NET_ADMIN)) {
 			err = -EPERM;
 			break;
 		}
@@ -918,8 +917,7 @@ static int dgram_setsockopt(struct sock *sk, int level, int optname,
 		}
 		break;
 	case WPAN_SECURITY_LEVEL:
-		if (!ns_capable(net->user_ns, CAP_NET_ADMIN) &&
-		    !ns_capable(net->user_ns, CAP_NET_RAW)) {
+		if (!ns_capable_any(net->user_ns, CAP_NET_RAW, CAP_NET_ADMIN)) {
 			err = -EPERM;
 			break;
 		}
diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
index 445a9ecaefa1..2da0a450edf6 100644
--- a/net/ipv4/ip_sockglue.c
+++ b/net/ipv4/ip_sockglue.c
@@ -1339,8 +1339,7 @@ static int do_ip_setsockopt(struct sock *sk, int level, int optname,
 		break;
 
 	case IP_TRANSPARENT:
-		if (!!val && !ns_capable(sock_net(sk)->user_ns, CAP_NET_RAW) &&
-		    !ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN)) {
+		if (!!val && !ns_capable_any(sock_net(sk)->user_ns, CAP_NET_RAW, CAP_NET_ADMIN)) {
 			err = -EPERM;
 			break;
 		}
diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
index 222f6bf220ba..25babd7ce844 100644
--- a/net/ipv6/ipv6_sockglue.c
+++ b/net/ipv6/ipv6_sockglue.c
@@ -634,8 +634,7 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname,
 		break;
 
 	case IPV6_TRANSPARENT:
-		if (valbool && !ns_capable(net->user_ns, CAP_NET_RAW) &&
-		    !ns_capable(net->user_ns, CAP_NET_ADMIN)) {
+		if (valbool && !ns_capable_any(net->user_ns, CAP_NET_RAW, CAP_NET_ADMIN)) {
 			retv = -EPERM;
 			break;
 		}
diff --git a/net/unix/scm.c b/net/unix/scm.c
index aa27a02478dc..6c47baf04d7d 100644
--- a/net/unix/scm.c
+++ b/net/unix/scm.c
@@ -99,7 +99,7 @@ static inline bool too_many_unix_fds(struct task_struct *p)
 	struct user_struct *user = current_user();
 
 	if (unlikely(user->unix_inflight > task_rlimit(p, RLIMIT_NOFILE)))
-		return !capable(CAP_SYS_RESOURCE) && !capable(CAP_SYS_ADMIN);
+		return !capable_any(CAP_SYS_RESOURCE, CAP_SYS_ADMIN);
 	return false;
 }
 
-- 
2.36.1


  parent reply	other threads:[~2022-06-15 15:27 UTC|newest]

Thread overview: 33+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-02-17 14:49 [RFC PATCH 2/2] capability: use new capable_or functionality Christian Göttsche
2022-02-17 14:49 ` [RFC PATCH 1/2] capability: add capable_or to test for multiple caps with exactly one audit message Christian Göttsche
2022-05-02 16:00   ` [PATCH v2 2/8] capability: use new capable_or functionality Christian Göttsche
2022-05-02 16:00     ` [PATCH v2 3/8] block: " Christian Göttsche
2022-05-02 16:00     ` [PATCH v2 4/8] drivers: " Christian Göttsche
2022-05-09 10:44       ` Jiri Slaby
2022-05-09 10:46       ` Hans Verkuil
2022-05-02 16:00     ` [PATCH v2 5/8] fs: " Christian Göttsche
2022-05-02 16:00     ` [PATCH v2 6/8] kernel: " Christian Göttsche
2022-05-02 16:00     ` [PATCH v2 7/8] kernel/bpf: " Christian Göttsche
2022-05-02 16:00     ` [PATCH v2 8/8] net: " Christian Göttsche
2022-05-09 17:15       ` Serge E. Hallyn
2022-05-22 17:33         ` Serge E. Hallyn
2022-05-02 16:00     ` [PATCH v2 1/8] capability: add capable_or to test for multiple caps with exactly one audit message Christian Göttsche
2022-05-09 17:12       ` Serge E. Hallyn
2022-06-15 15:26       ` [PATCH v3 2/8] capability: use new capable_any functionality Christian Göttsche
2022-06-15 15:26         ` [PATCH v3 3/8] block: " Christian Göttsche
2022-06-16  3:00           ` Bart Van Assche
2022-06-15 15:26         ` [PATCH v3 4/8] drivers: " Christian Göttsche
2022-06-15 15:45           ` Laurent Pinchart
2022-06-15 15:26         ` [PATCH v3 5/8] fs: " Christian Göttsche
2022-06-28 12:56           ` Christian Brauner
2022-06-28 14:11             ` Christian Göttsche
2022-06-15 15:26         ` [PATCH v3 6/8] kernel: " Christian Göttsche
2022-06-15 15:26         ` [PATCH v3 7/8] bpf: " Christian Göttsche
2022-06-15 15:26         ` Christian Göttsche [this message]
2022-06-15 15:26         ` [PATCH v3 1/8] capability: add any wrapper to test for multiple caps with exactly one audit message Christian Göttsche
2022-06-26 22:34           ` Serge E. Hallyn
2022-08-30 15:05             ` Christian Göttsche
2022-08-30 15:10               ` Paul Moore
2022-09-02  0:56           ` Paul Moore
2022-09-02  1:35             ` Paul Moore
2022-02-17 17:29 ` [RFC PATCH 2/2] capability: use new capable_or functionality Alexei Starovoitov

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20220615152623.311223-7-cgzones@googlemail.com \
    --to=cgzones@googlemail.com \
    --cc=alex.aring@gmail.com \
    --cc=asml.silence@gmail.com \
    --cc=davem@davemloft.net \
    --cc=dsahern@kernel.org \
    --cc=edumazet@google.com \
    --cc=imagedong@tencent.com \
    --cc=kuba@kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-security-module@vger.kernel.org \
    --cc=linux-wpan@vger.kernel.org \
    --cc=netdev@vger.kernel.org \
    --cc=nikolay@nvidia.com \
    --cc=pabeni@redhat.com \
    --cc=rpalethorpe@suse.com \
    --cc=selinux@vger.kernel.org \
    --cc=serge@hallyn.com \
    --cc=sgarzare@redhat.com \
    --cc=socketcan@hartkopp.net \
    --cc=stefan@datenfreihafen.org \
    --cc=tglx@linutronix.de \
    --cc=weiwan@google.com \
    --cc=william.xuanziyang@huawei.com \
    --cc=yangbo.lu@nxp.com \
    --cc=yoshfuji@linux-ipv6.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.