From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751217AbdEBRMC (ORCPT ); Tue, 2 May 2017 13:12:02 -0400 Received: from mail-eopbgr00117.outbound.protection.outlook.com ([40.107.0.117]:59952 "EHLO EUR02-AM5-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1751007AbdEBRL7 (ORCPT ); Tue, 2 May 2017 13:11:59 -0400 Authentication-Results: redhat.com; dkim=none (message not signed) header.d=none;redhat.com; dmarc=none action=none header.from=virtuozzo.com; Subject: [PATCH v2] security: Use user_namespace::level to avoid redundant iterations in cap_capable() From: Kirill Tkhai To: , , , , , , , , , , , , , , , Date: Tue, 2 May 2017 20:11:52 +0300 Message-ID: <149374507992.8805.9670925184482786336.stgit@localhost.localdomain> User-Agent: StGit/0.17.1-dirty MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit X-Originating-IP: [195.214.232.6] X-ClientProxiedBy: DB6PR02CA0013.eurprd02.prod.outlook.com (10.170.218.154) To AM4PR0802MB2273.eurprd08.prod.outlook.com (10.172.217.151) X-MS-Office365-Filtering-Correlation-Id: 9ded102b-5a3b-4ed6-958d-08d4917e55bd X-Microsoft-Antispam: UriScan:;BCL:0;PCL:0;RULEID:(22001)(201703131423075)(201703031133081);SRVR:AM4PR0802MB2273; X-Microsoft-Exchange-Diagnostics: 1;AM4PR0802MB2273;3:e+C4TiExzJAyfPjQ8H3xtnTYWCyBww7kuTgmD0xn855iRN5mgbL1mR2d3TRUCt0hYNg1htdBnbBws+prR06Fet6kXeMnaEXTAlHf2iA2zy7oItK0VdZlWaRMs9CNX2ymrtz+4Hz/G8F9o2WoJEZ0auUE1eEjNeusNdOzA5EFCsV4guewj7DiofXJIG4C+b2unmLQxMDAi3jlUefQSQ9VoOpxAlJ4o5j566SROnpVGb/HPUqcFyRZ8oIEiSn3w0hMAy7+e8IXZ9gxEMnnAztuOJHpk0DK7o2p2LVxIQ+28k7DBrQP/8g5Faixy8kiveadi0z9PoJ3MUuOcaVT1GC5ug==;25:HSMWlq6xtl+cwH9PcEVwDefHRcFvaz6rAxCNjFXymXKYajl7Rt7WrauZ5DqmcUYnb99Nh/KUFIgOf2wgcW4/tfbdOEktdxnjwrIk1s6qqlvLtB5AZFTh6v+BHEfDBQnAgyk5bho8ZTZMKxb+BFDAzJVrQ9aRkKvyNGUFQCHNPfQNSOskdDvCxuiNFJhDfX2577y3hhG8hU9B2D4YDQqyzbgTUeAJ03P8JXSRDi4GgYs9Xey1poVCeR3HLoRrdimFw1EkmudcdIcLJ+WDYGH96lNMNxDJ6ZTnEk17MTuUnoXjzpFgt/IJTJ9HX4+VJe7tgRMhkQJKUuO5Tk9Y7ZZUMI18XTfXlqeGsX2qyhFn4Dq0Y5DvBKUSQwljgNgWriLDOEdeNABRYl5//3QxMyNrK4aeRhkiBJyDgaQcirKHb8rqcyYVP4vOvra3HqZsFlACDjavGHldk5ee6JT45xH6iw== X-Microsoft-Exchange-Diagnostics: 1;AM4PR0802MB2273;31:Cl2aqElE3PKTXJrTg/02c2Q9rtXAlTNxpS7PT3BMuCeU9NpIMadA9VE467yzg7semmrSE6fDl2XOjLHoXvxTFz5kynGYdivJZrYuTM7lwS2AYwTNf+zjd74oLM+TKjbfmt20sxoRfcnePv3rqFZFQ5SjlyWrK6kX7ZCwj7TBAZRzPYk9grxfCVBnlzyUI4eb3Ke571iAptlChk8onLn8NFInctbJQnjAz975GYGd6CY=;20:9ddqbX+KEciIMsNplMRqilDtTB/j00IYAlN5kM1NvB1JkUV8pHbUeESnmW0RNQS97KWo1ctzQEqkvTlPLZ6llo+eaXV2E5bAwHymvEAXH07GNhOqIqT+tQKsOEXRuFJ+Nx/W0zRNF1uXL0vbI457IvxOX0ZZMn23qiX6K+DFRlOW/2jP4h5DnCpc9WXdFXwr3vv5MMM79siST0M3QuPA5Y5UgE8yRI5/szwtqgOXgQfK4Ai0lT1QgURGqeSXscpRKCoGUtpuLq6dx3g6kEOZIzFzLFq7tx8vuiMfdFIQcx8DOQf79gy/czC58q751G/3jcsLqfqlUXQSGZMeFVw5ezPqvCaH8wldNYN3Ahuvsn1aK/zH3vFowESp9yKj4jSap+J1BUhmm8zoNPdEutsaZPM6M4aTMTutZNi8HqU6N0s= X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:(192374486261705); X-Exchange-Antispam-Report-CFA-Test: BCL:0;PCL:0;RULEID:(6040450)(601004)(2401047)(8121501046)(5005006)(10201501046)(3002001)(93006095)(93001095)(6041248)(20161123562025)(20161123560025)(20161123555025)(20161123558100)(20161123564025)(201703131423075)(201702281528075)(201703061421075)(201703061406153)(6072148);SRVR:AM4PR0802MB2273;BCL:0;PCL:0;RULEID:;SRVR:AM4PR0802MB2273; X-Microsoft-Exchange-Diagnostics: 1;AM4PR0802MB2273;4:cmib5iNfkYiCenJNAMAogsS0a1r/7AxFfVrkGiUbUpWmM+oSfAIhMKxNTZUfsXKPN6ZCYiyp4Yi2CYF4s66n8MpwtPWdu7NI4FZy4rKr+/GAemQT+gapk5s67cJE90ukBDO2ZNO3VO5V+HRNevNmJ4o7mssa6CMylgwMJHge1m4so/y+KK+SPO63S2bC+mdGguuz7kjru88xCAtqFBfOi9tDFbw6AUOjJ9cZeOeVcRw0MA2RiIT/rFqFzCmoyts06lBeBmRnXFeDogHDmzbVTc0zr0u6oe10amLdj24LEBwZBqnwu25jrQnhJUsaxrlyhrHwGQJG8t5eJkpjVu1Zewap1kolewMD3sJRyj0WJ8eAv5DUCEv5lolUfOpsI03S8PHHsqYsNOE4J6jxr3hR4egcBcwAueNh50CsFCU8ORTub2Qxk4vfMzfejETvXSUnseAVShyHy8/updCpIjTKfKbnT/jRKMCpjtLBxeVgz9p03rHd6t9ikDUXt10hAzk8YqZljDW4GxTxgL8IwgJ2ihiIxfc35unT8s9dPQG+uGRJfAPa6b8w+/L7IcYZnYKMoKXL3Iw0tnAB2iM7IC8DBQs71cBJ52bZhvPjJzCx38nuQW7yu0XkXC0cbNHIV80bpS7L/UZrjTnrhg8bzQMKVPDDT25FhSIEWVVne/eL7zrpcAUfw6hNGBG0GRFlsGD4fRrM/eaGCN+QzV+uDGrN/OKeXfGiLCnUURI+T1/wpOtelg/PqHxV1jQLaip3ElcR/IU5sz0OGrqCu8GP4hGH2fvP6DmvDtDDSx0H5lbe1kU2hFMf5BUBzGzk8tDhiwq879XmUk0b0GQ/iN4mVuzoxQ== X-Forefront-PRVS: 02951C14DC X-Forefront-Antispam-Report: SFV:NSPM;SFS:(10019020)(4630300001)(6069001)(6009001)(39450400003)(39410400002)(39400400002)(39840400002)(23676002)(83506001)(81166006)(103116003)(230700001)(47776003)(61506002)(25786009)(55016002)(6506006)(4001350100001)(9686003)(53936002)(189998001)(38730400002)(2906002)(50466002)(8676002)(478600001)(54356999)(50986999)(42186005)(66066001)(86362001)(305945005)(7736002)(33646002)(15650500001)(5660300001)(2201001)(6116002)(3846002)(921003)(1121003);DIR:OUT;SFP:1102;SCL:1;SRVR:AM4PR0802MB2273;H:localhost.localdomain;FPR:;SPF:None;MLV:sfv;LANG:en; X-Microsoft-Exchange-Diagnostics: =?utf-8?B?MTtBTTRQUjA4MDJNQjIyNzM7MjM6UitjVzI4a3RyK0RZMUxPeFhyL1p0Yldo?= =?utf-8?B?aDQ0WGNhU2ZZSDhOeHVwb3FReDFqVzVHNnpkR1RQMU5td2FIanlmZkNYSU5o?= =?utf-8?B?VVFKdEdhdVY5bzJSclFmZVZ2OUEvSlVvb241UFREY0gwWGR5OWczQi9vMTEr?= =?utf-8?B?QmhmVWhyYVcvY0NueTdkNnlxbWtkVGIxZjFyYXppQ1ZVc1lFQnpGNytTb0xw?= =?utf-8?B?R1NCS0NjaVdGOWZXbk0rM29ValhEMWtPcTlhTElGNUNrTzF2WTY5ZGRpVUdx?= =?utf-8?B?TmthSG9DNkhPS1M5cE1wcStOUE84SmFBY3d0ZTgzUkQ3UXgyS0diRExNMlZp?= =?utf-8?B?VHN4M1BtcjZwdTZISFJRZ2xJY1NFNGJzTFIzWDdTNG9UWWk5U0kwVExSa2ky?= =?utf-8?B?NlFMdkRjdUNJNGEvbnk0YnhsWGlUc2NDVlVHVktTaEdqTTFIa09lQXNUcGpQ?= =?utf-8?B?cEx2UFA3YXZZR3ZPMFBzMWZBdUFRK1Nla2FKdXVwNlN3amp6eDRibFN0Zk1v?= =?utf-8?B?NUt2UVZScEFXa1RmWExwdS9WVExnUzBxWCsyTmtBN01KK0tERVZNbnlYZUVZ?= =?utf-8?B?U0tyMVl3VDFPa2hPSWNmakhzYmFIMTlDcmV1Y3dudE8rWlNUaldNQVJCaUtp?= =?utf-8?B?N1BVczNqaE9OaWRoTE0wWnUvRFBKWlZtRW9mYW1uU0t0ZjArdGkzMW9GV1ov?= =?utf-8?B?RTkrY2kxaENXZFJCZDRwUFNqQmJhTURNOXhSajVwelovbldXN2ZvdGUxZ3hR?= =?utf-8?B?aFI5Qjg1aEhlOGd0dzR6SnI3TkZNanZsZm9NUTI2T2pGaWswbjBlRVNTN1ho?= =?utf-8?B?a2lzUEdrbENmUjlTcGROcExpMy9KVnhDRnByZU9lWjRDMmpIenFsS0p4NTE0?= =?utf-8?B?T1g1SXpCbkN0TnN0WjR4dDBNRytjdkFHTTZLVnlkQnIvZHk0V3B0U0lpeWsy?= =?utf-8?B?eVNyM1VoSGhCMjErZjQ0SWQ4ZU9jelg3aU1Wd2laT2xEbXo0TlNtVDEyc0Vr?= =?utf-8?B?eERibFVMSm84THVEZStlWTAvUjJkdmlZTUNudDF0dUNBN0svVGFXdk5wUDFU?= =?utf-8?B?NFJHdUFHM0hrNGlPQjBxNjNscFJXMkh3OGhsYWpBV2diMEFvb25OUmR1Z0dD?= =?utf-8?B?NXdQTlRRN3BBT2dkaml4TlBHYlYxT09iVjR5MGhicU5pT2xTbWsxWlp3MVFS?= =?utf-8?B?dzFnZEJsNUpra1Y2aGVRN0tqZ2ZCeWRSU0k4YU9zSGxDNGZKUGM2WEVCV1hJ?= =?utf-8?B?ZzRTbGsrbmtidXd3RmpBUkFZdThDdVBKWDM2MUgrcldBMzhtbjhHN2F4aWJx?= =?utf-8?B?aTFDNmlGWDJUbFhZRnNuTUZwN1VOYWFVLzhTcHhGcTgwZGJuS3NOblNVM2Rv?= =?utf-8?B?M0hFaExPbitIODZzZm8rZVhvY0d1b1hiOCtMUzg2aWc9PQ==?= X-Microsoft-Exchange-Diagnostics: 1;AM4PR0802MB2273;6:JNDxBRtg9JxE/c8etbtymAChk72sy+6WxwrkXcs2qcBrSSWCjKuRxBDfLgFP5mAS4spNpxsWtPGgsIIExMIVww9G4wIFcG9Wi2pdWhaFs/+oUpCoymiKpQ2PISD00S5Pj0Tb/1diuvOs1uMEidNUwWCfYR/TthgqD4jjDpc/z38/6+khaE4/fFSR4w2ld48L0XoXvOQWTugmzRM/PKa747/pxcPqybDYUD3pxi972lJ4Us3b0Xw5jjAc4dcHMVP/8nzj8bWEpmqEm6/8ti2mr9yeFrP2XA9TLfO4TyRuJFhrzdyreg2TeO/u2J4UkcYCe45tjgElz3kuWnP3te8E+upvgsZtYJquzz7xS0eDlcQM6tCo78noWIwj/UvEB0Z5/cKUr9D8qO4h8fD19nLPXtfnimsS7rBlefbNIPy08NPXtBbpDOIvz9e/L5C0dZv47TefnMU9faSK3ktjYYLUu6ANT+za35MRPO2KlTMKqyvZb3Ilfqk6oxqhvbLqppjrpwTCXYUwU0je2c1g2BaGNw==;5:1S/fwZwcUMhwCBLnrcwx3JWTrRc5qhRV/slQIYZxfhG41UX1ToVn48oE+PDooubJDx0/rl+dI3DDatdUgaa/tQS1UKvGPsfOZ9SznUaMYqPd8Z1aVtzNuuHlK/wDiQQXSuEWCKyz/U7qsPzcz85prQjAvJU3na44gvM3IiEzeGI=;24:7fp4MpqbmGNJYYpyZe0EBhF73bc0B3dej21UQ3APtBDKNgCZiz0moU+UmVsRDcazQSPAfoB1+AzUXChcRjDHiAI33JtlpXBskxZkgHAzxoI= SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-Microsoft-Exchange-Diagnostics: 1;AM4PR0802MB2273;7:gcEAHMCFK1P1MtOK6Az0ephg+JwA7qhL5wS2e4pqutF5RGPcWgMeQ0IWdsJRRTqDxTmxuDryeln8xuuzOJyZtbSjOElDnARcuGsBmuuy3rwEqJk2X7P0OAbqHi9oFwplNPg4YRrTCMSklEBC5nClP8/zcn+6PA32a+6M8q9bb6QWsFWg2wP5KPDPMO/WX/hDAoEbX/Uh4p++Iao4lZNbLxIDLKc5naj9fH65Knijb2xVgiGADNCUci2Ve3tOOYnOU5bi/6P4xWuDYxEcgzyCT2W5YEYwqeOf1fYZjkCVLcGLQ2s4pSGF0VUlAejNVIGWabOcmj2Hz7NXcqJBhy5FXQ==;20:tZBU8t6okfhpYOIwPa+/tW8x14cWK211e/0xkh/1g9IIQ3WuVRwADmtdkooMdKvmVV9YmoEx47peLeRi0TYXZOkuTjFDLn3gc/D7skkCw2+R/JCUjOT6HxZVvGFpfC8burAdq6eePtdPqZfBuwpt96AmViSvRC4gjeCmlylYXXA= X-OriginatorOrg: virtuozzo.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 02 May 2017 17:11:54.1477 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM4PR0802MB2273 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org When ns->level is not larger then cred->user_ns->level, then ns can't be cred->user_ns's descendant, and there is no a sence to search in parents. So, breake the cycle earlier and skip needless iterations. v2: Change comment on suggested by Andy Lutomirski. Signed-off-by: Kirill Tkhai --- security/commoncap.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/security/commoncap.c b/security/commoncap.c index 78b37838a2d3..a424aa0123af 100644 --- a/security/commoncap.c +++ b/security/commoncap.c @@ -82,8 +82,11 @@ int cap_capable(const struct cred *cred, struct user_namespace *targ_ns, if (ns == cred->user_ns) return cap_raised(cred->cap_effective, cap) ? 0 : -EPERM; - /* Have we tried all of the parent namespaces? */ - if (ns == &init_user_ns) + /* + * If we're already at a lower level than we're looking for, we're + * done searching. + */ + if (ns->level <= cred->user_ns->level) return -EPERM; /*