fs: Reorder inode_owner_or_capable() to avoid needless

Checking for capabilities should be the last operation when performing access control tests so that PF_SUPERPRIV is set only when it was required for success (implying that the capability was needed for the operation).

Reported-by Solar Designer <[email protected]>

Cc Serge E. Hallyn <[email protected]>

Cc Andy Lutomirski <[email protected]>

Signed-off-by Kees Cook <[email protected]>

---
 fs/inode.c | 2 +-
 fs/namei.c | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

fs/inode.c +1 -1

index db5914783a71..7092debe90cc 100644
@@ -2023,7 +2023,7 @@ bool inode_owner_or_capable(const struct inode *inode)
 		return true;
 
 	ns = current_user_ns();
-	if (ns_capable(ns, CAP_FOWNER) && kuid_has_mapping(ns, inode->i_uid))
+	if (kuid_has_mapping(ns, inode->i_uid) && ns_capable(ns, CAP_FOWNER))
 		return true;
 	return false;
 }

fs/namei.c +1 -1

index 6571a5f5112e..efe53a5d0737 100644
@@ -1008,7 +1008,7 @@ static int may_linkat(struct path *link)
 	/* Source inode owner (or CAP_FOWNER) can hardlink all they like,
 	 * otherwise, it must be a safe source.
 	 */
-	if (inode_owner_or_capable(inode) || safe_hardlink_source(inode))
+	if (safe_hardlink_source(inode) || inode_owner_or_capable(inode))
 		return 0;
 
 	audit_log_link_denied("linkat", link);

Signature · 6 lines

2.7.4


-- 
Kees Cook
Pixel Security

Checking for capabilities should be the last operation when performing access control tests so that PF_SUPERPRIV is set only when it was required for success (implying that the capability was needed for the operation).

Checking for capabilities should be the last operation when performing access control tests so that PF_SUPERPRIV is set only when it was required for success (implying that the capability was needed for the operation).