From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932335AbeCIV5I (ORCPT ); Fri, 9 Mar 2018 16:57:08 -0500 Received: from mail.kernel.org ([198.145.29.99]:52314 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932104AbeCIV5H (ORCPT ); Fri, 9 Mar 2018 16:57:07 -0500 DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 737ED2133D Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=kernel.org Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=jaegeuk@kernel.org Date: Fri, 9 Mar 2018 13:57:05 -0800 From: Jaegeuk Kim To: Chao Yu Cc: linux-kernel@vger.kernel.org, linux-f2fs-devel@lists.sourceforge.net Subject: Re: [PATCH] f2fs: avoid selinux denial on CAP_SYS_RESOURCE Message-ID: <20180309215705.GB56123@jaegeuk-macbookpro.roam.corp.google.com> References: <20180309044900.39677-1-jaegeuk@kernel.org> <5ec9338e-1522-2b6a-99c2-ffe70b7a06a9@huawei.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <5ec9338e-1522-2b6a-99c2-ffe70b7a06a9@huawei.com> User-Agent: Mutt/1.8.2 (2017-04-18) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 03/09, Chao Yu wrote: > On 2018/3/9 12:49, Jaegeuk Kim wrote: > > This fixes CAP_SYS_RESOURCE denial of selinux when using resgid. > > A little confusion, if capable(CAP_SYS_RESOURCE) is false, we still have chance > to return true for below resuid & resgid cases, right? I didn't dig it deeply tho, it seems selinux log came up when capable() is failed in the first place. We actually didn't need to show it up, since next resgid will give mostly true. > > Thanks, > > > > > Signed-off-by: Jaegeuk Kim > > --- > > fs/f2fs/f2fs.h | 4 ++-- > > 1 file changed, 2 insertions(+), 2 deletions(-) > > > > diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h > > index f6dc70666ebb..3d12277fbe9e 100644 > > --- a/fs/f2fs/f2fs.h > > +++ b/fs/f2fs/f2fs.h > > @@ -1607,13 +1607,13 @@ static inline bool __allow_reserved_blocks(struct f2fs_sb_info *sbi, > > return false; > > if (IS_NOQUOTA(inode)) > > return true; > > - if (capable(CAP_SYS_RESOURCE)) > > - return true; > > if (uid_eq(sbi->s_resuid, current_fsuid())) > > return true; > > if (!gid_eq(sbi->s_resgid, GLOBAL_ROOT_GID) && > > in_group_p(sbi->s_resgid)) > > return true; > > + if (capable(CAP_SYS_RESOURCE)) > > + return true; > > return false; > > } > > > >