Skip to contentSkip to conversation

f2fs: avoid selinux denial on CAP_SYS_RESOURCE

PATCH In review Jaegeuk Kim 3 participants 4 messages Mar 9, 2018 – Mar 14, 2018 F2FS file system

lore
Share & tools
lore

Jaegeuk Kim

author maintainer
#0 lore raw

PATCH 1/1 f2fs: avoid selinux denial on CAP_SYS_RESOURCE

This fixes CAP_SYS_RESOURCE denial of selinux when using resgid.

Signed-off-by Jaegeuk Kim <[email protected]>
---
 fs/f2fs/f2fs.h | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
fs/f2fs/f2fs.h +2 -2
index f6dc70666ebb..3d12277fbe9e 100644
@@ -1607,13 +1607,13 @@ static inline bool __allow_reserved_blocks(struct f2fs_sb_info *sbi,
 		return false;
 	if (IS_NOQUOTA(inode))
 		return true;
-	if (capable(CAP_SYS_RESOURCE))
-		return true;
 	if (uid_eq(sbi->s_resuid, current_fsuid()))
 		return true;
 	if (!gid_eq(sbi->s_resgid, GLOBAL_ROOT_GID) &&
 					in_group_p(sbi->s_resgid))
 		return true;
+	if (capable(CAP_SYS_RESOURCE))
+		return true;
 	return false;
 }
Signature · 1 line
2.15.0.531.g2ccb3012c9-goog
#1 lore raw
Quoted 1 line · Jaegeuk Kim

This fixes CAP_SYS_RESOURCE denial of selinux when using resgid.

A little confusion, if capable(CAP_SYS_RESOURCE) is false, we still have chance to return true for below resuid & resgid cases, right?

Thanks,

Quoted 27 lines
Signed-off-by Jaegeuk Kim <[email protected]>
---
 fs/f2fs/f2fs.h | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
fs/f2fs/f2fs.h +2 -2
index f6dc70666ebb..3d12277fbe9e 100644
@@ -1607,13 +1607,13 @@ static inline bool __allow_reserved_blocks(struct f2fs_sb_info *sbi,
 		return false;
 	if (IS_NOQUOTA(inode))
 		return true;
-	if (capable(CAP_SYS_RESOURCE))
-		return true;
 	if (uid_eq(sbi->s_resuid, current_fsuid()))
 		return true;
 	if (!gid_eq(sbi->s_resgid, GLOBAL_ROOT_GID) &&
 					in_group_p(sbi->s_resgid))
 		return true;
+	if (capable(CAP_SYS_RESOURCE))
+		return true;
 	return false;
 }
author maintainer
#2 lore raw
Quoted 5 lines · Chao Yu
Quoted 1 line · Jaegeuk Kim

This fixes CAP_SYS_RESOURCE denial of selinux when using resgid.

A little confusion, if capable(CAP_SYS_RESOURCE) is false, we still have chance to return true for below resuid & resgid cases, right?

I didn't dig it deeply tho, it seems selinux log came up when capable() is failed in the first place. We actually didn't need to show it up, since next resgid will give mostly true.

Quoted 30 lines

Thanks,

Quoted 27 lines
Signed-off-by Jaegeuk Kim <[email protected]>
---
 fs/f2fs/f2fs.h | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
fs/f2fs/f2fs.h +2 -2
index f6dc70666ebb..3d12277fbe9e 100644
@@ -1607,13 +1607,13 @@ static inline bool __allow_reserved_blocks(struct f2fs_sb_info *sbi,
 		return false;
 	if (IS_NOQUOTA(inode))
 		return true;
-	if (capable(CAP_SYS_RESOURCE))
-		return true;
 	if (uid_eq(sbi->s_resuid, current_fsuid()))
 		return true;
 	if (!gid_eq(sbi->s_resgid, GLOBAL_ROOT_GID) &&
 					in_group_p(sbi->s_resgid))
 		return true;
+	if (capable(CAP_SYS_RESOURCE))
+		return true;
 	return false;
 }
maintainer Reviewed-by
#3 lore raw
Quoted 10 lines · Jaegeuk Kim
Quoted 5 lines · Chao Yu
Quoted 1 line · Jaegeuk Kim

This fixes CAP_SYS_RESOURCE denial of selinux when using resgid.

A little confusion, if capable(CAP_SYS_RESOURCE) is false, we still have chance to return true for below resuid & resgid cases, right?

I didn't dig it deeply tho, it seems selinux log came up when capable() is failed in the first place. We actually didn't need to show it up, since next resgid will give mostly true.

Got it, how about adding this reason into commit message? Anyway,

Reviewed-by Chao Yu <[email protected]>

Thanks,

Quoted 40 lines
Quoted 23 lines

Thanks,

Quoted 19 lines
Signed-off-by Jaegeuk Kim <[email protected]>
---
 fs/f2fs/f2fs.h | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
fs/f2fs/f2fs.h +0 -2
index f6dc70666ebb..3d12277fbe9e 100644
@@ -1607,13 +1607,13 @@ static inline bool __allow_reserved_blocks(struct f2fs_sb_info *sbi,
 		return false;
 	if (IS_NOQUOTA(inode))
 		return true;
-	if (capable(CAP_SYS_RESOURCE))
-		return true;
 	if (uid_eq(sbi->s_resuid, current_fsuid()))
 		return true;
 	if (!gid_eq(sbi->s_resgid, GLOBAL_ROOT_GID) &&
Quoted 8 lines

fs/f2fs/f2fs.h static inline bool __allow_reserved_blocks(struct f2fs_sb_info *sbi, · line 1619

Quoted 8 lines
fs/f2fs/f2fs.h +2 -0
 					in_group_p(sbi->s_resgid))
 		return true;
+	if (capable(CAP_SYS_RESOURCE))
+		return true;
 	return false;
 }

------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most engaging tech sites, Slashdot.org! http://sdm.link/slashdot
_______________________________________________
Linux-f2fs-devel mailing list [email protected]
https://lists.sourceforge.net/lists/listinfo/linux-f2fs-devel