mirror of https://lore.kernel.org/lkml/
 help / color / mirror / Atom feed
From: "Serge E. Hallyn" <serge@hallyn.com>
To: Andrew Morton <akpm@linux-foundation.org>
Cc: "Serge E. Hallyn" <serge@hallyn.com>,
	LSM <linux-security-module@vger.kernel.org>,
	James Morris <jmorris@namei.org>,
	Kees Cook <kees.cook@canonical.com>,
	containers@lists.linux-foundation.org,
	kernel list <linux-kernel@vger.kernel.org>,
	"Eric W. Biederman" <ebiederm@xmission.com>,
	Alexey Dobriyan <adobriyan@gmail.com>,
	Michael Kerrisk <mtk.manpages@gmail.com>,
	xemul@parallels.com, dhowells@redhat.com
Subject: Re: [PATCH 4/9] allow killing tasks in your own or child userns
Date: Thu, 24 Feb 2011 00:48:18 +0000	[thread overview]
Message-ID: <20110224004818.GA11822@mail.hallyn.com> (raw)
In-Reply-To: <20110218155921.440f1137.akpm@linux-foundation.org>

Quoting Andrew Morton (akpm@linux-foundation.org):
> On Thu, 17 Feb 2011 15:03:25 +0000
> "Serge E. Hallyn" <serge@hallyn.com> wrote:
> 
> >  /*
> > + * called with RCU read lock from check_kill_permission()
> > + */
> > +static inline int kill_ok_by_cred(struct task_struct *t)
> > +{
> > +	const struct cred *cred = current_cred();
> > +	const struct cred *tcred = __task_cred(t);
> > +
> > +	if (cred->user->user_ns == tcred->user->user_ns &&
> > +	    (cred->euid == tcred->suid ||
> > +	     cred->euid == tcred->uid ||
> > +	     cred->uid  == tcred->suid ||
> > +	     cred->uid  == tcred->uid))
> > +		return 1;
> > +
> > +	if (ns_capable(tcred->user->user_ns, CAP_KILL))
> > +		return 1;
> > +
> > +	return 0;
> > +}
> 
> The compiler will inline this for us.

Is that simply true with everything (worth inlining) nowadays, or is
there a particular implicit hint to the compiler that'll make that
happen?

Not that I guess it's even particularly important in this case.

From: Serge E. Hallyn <serge.hallyn@canonical.com>
Date: Thu, 24 Feb 2011 00:26:02 +0000
Subject: [PATCH 1/2] userns: let compiler inline kill_ok_by_cred (per akpm)

Signed-off-by: Serge E. Hallyn <serge.hallyn@canonical.com>
---
 kernel/signal.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/kernel/signal.c b/kernel/signal.c
index ffe4bdf..12702b4 100644
--- a/kernel/signal.c
+++ b/kernel/signal.c
@@ -638,7 +638,7 @@ static inline bool si_fromuser(const struct siginfo *info)
 /*
  * called with RCU read lock from check_kill_permission()
  */
-static inline int kill_ok_by_cred(struct task_struct *t)
+static int kill_ok_by_cred(struct task_struct *t)
 {
 	const struct cred *cred = current_cred();
 	const struct cred *tcred = __task_cred(t);
-- 
1.7.0.4


  reply	other threads:[~2011-02-24  0:48 UTC|newest]

Thread overview: 68+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2011-02-17 15:02 userns: targeted capabilities v5 Serge E. Hallyn
2011-02-17 15:02 ` [PATCH 1/9] Add a user_namespace as creator/owner of uts_namespace Serge E. Hallyn
2011-02-18  3:31   ` Eric W. Biederman
2011-02-18 16:57   ` Daniel Lezcano
2011-02-18 23:59   ` Andrew Morton
2011-02-17 15:03 ` [PATCH 2/9] security: Make capabilities relative to the user namespace Serge E. Hallyn
2011-02-18  3:46   ` Eric W. Biederman
2011-02-18 23:44   ` Daniel Lezcano
2011-02-18 23:59   ` Andrew Morton
2011-02-17 15:03 ` [PATCH 3/9] allow sethostname in a container Serge E. Hallyn
2011-02-18  3:05   ` Eric W. Biederman
2011-02-18 23:46   ` Daniel Lezcano
2011-02-17 15:03 ` [PATCH 4/9] allow killing tasks in your own or child userns Serge E. Hallyn
2011-02-18  3:00   ` Eric W. Biederman
2011-02-18 23:59   ` Andrew Morton
2011-02-24  0:48     ` Serge E. Hallyn [this message]
2011-02-24  0:54       ` Andrew Morton
2011-02-19 10:55   ` Daniel Lezcano
2011-02-17 15:03 ` [PATCH 5/9] Allow ptrace from non-init user namespaces Serge E. Hallyn
2011-02-18  2:59   ` Eric W. Biederman
2011-02-18  4:36     ` Serge E. Hallyn
2011-02-24  0:49       ` [PATCH] userns: ptrace: incorporate feedback from Eric Serge E. Hallyn
2011-02-24  0:56         ` Andrew Morton
2011-02-24  3:15           ` Serge E. Hallyn
2011-02-18 23:59   ` [PATCH 5/9] Allow ptrace from non-init user namespaces Andrew Morton
2011-02-24  0:43     ` Serge E. Hallyn
2011-02-19 17:49   ` Daniel Lezcano
2011-02-17 15:03 ` [PATCH 6/9] user namespaces: convert all capable checks in kernel/sys.c Serge E. Hallyn
2011-02-18  1:57   ` Eric W. Biederman
2011-02-18 23:59   ` Andrew Morton
2011-02-19  0:01   ` Andrew Morton
2011-02-19 17:52   ` Daniel Lezcano
2011-02-17 15:03 ` [PATCH 7/9] add a user namespace owner of ipc ns Serge E. Hallyn
2011-02-18  3:19   ` Eric W. Biederman
2011-02-18 23:59   ` Andrew Morton
2011-02-19 17:57   ` Daniel Lezcano
2011-02-17 15:03 ` [PATCH 8/9] user namespaces: convert several capable() calls Serge E. Hallyn
2011-02-18  1:51   ` Eric W. Biederman
2011-02-19 19:07   ` Daniel Lezcano
2011-02-17 15:04 ` [PATCH 9/9] userns: check user namespace for task->file uid equivalence checks Serge E. Hallyn
2011-02-18  1:29   ` Eric W. Biederman
2011-02-18 23:59   ` Andrew Morton
2011-02-24  3:24     ` Serge E. Hallyn
2011-02-24  5:08       ` Andrew Morton
2011-02-19 19:22   ` Daniel Lezcano
2011-02-18  0:21 ` userns: targeted capabilities v5 Andrew Morton
2011-02-18  3:53   ` Eric W. Biederman
2011-02-18  4:28   ` Serge E. Hallyn
2011-02-23 11:40 ` [PATCH 2/9] security: Make capabilities relative to the user namespace David Howells
2011-02-23 12:01 ` David Howells
2011-02-23 13:43   ` Serge E. Hallyn
2011-02-23 12:05 ` User namespaces and keys David Howells
2011-02-23 13:58   ` Serge E. Hallyn
2011-02-23 14:46     ` Eric W. Biederman
2011-02-23 15:06   ` David Howells
2011-02-23 15:45     ` Eric W. Biederman
2011-02-23 15:53       ` Serge E. Hallyn
2011-02-23 19:24         ` Casey Schaufler
2011-02-23 20:55           ` Eric W. Biederman
2011-02-23 21:37             ` Casey Schaufler
2011-02-24  6:56               ` Eric W. Biederman
2011-02-23 16:59 ` [PATCH 2/9] security: Make capabilities relative to the user namespace David Howells
2011-02-23 17:05 ` [PATCH 5/9] Allow ptrace from non-init user namespaces David Howells
2011-02-23 17:11 ` David Howells
2011-02-23 17:16 ` [PATCH 1/9] Add a user_namespace as creator/owner of uts_namespace David Howells
2011-02-23 21:21   ` Eric W. Biederman
2011-02-23 23:19   ` David Howells
2011-02-23 23:54     ` Eric W. Biederman

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20110224004818.GA11822@mail.hallyn.com \
    --to=serge@hallyn.com \
    --cc=adobriyan@gmail.com \
    --cc=akpm@linux-foundation.org \
    --cc=containers@lists.linux-foundation.org \
    --cc=dhowells@redhat.com \
    --cc=ebiederm@xmission.com \
    --cc=jmorris@namei.org \
    --cc=kees.cook@canonical.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-security-module@vger.kernel.org \
    --cc=mtk.manpages@gmail.com \
    --cc=xemul@parallels.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox

Powered by JetHome