lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <20150928162905.GE1358@fieldses.org> Date: Mon, 28 Sep 2015 12:29:05 -0400 From: "J. Bruce Fields" <bfields@...ldses.org> To: Andreas Grünbacher <andreas.gruenbacher@...il.com> Cc: Andreas Gruenbacher <agruenba@...hat.com>, Alexander Viro <viro@...iv.linux.org.uk>, Theodore Ts'o <tytso@....edu>, Andreas Dilger <adilger.kernel@...ger.ca>, Jeff Layton <jlayton@...chiereds.net>, Trond Myklebust <trond.myklebust@...marydata.com>, Anna Schumaker <anna.schumaker@...app.com>, linux-ext4@...r.kernel.org, Linux Kernel Mailing List <linux-kernel@...r.kernel.org>, Linux FS-devel Mailing List <linux-fsdevel@...r.kernel.org>, Linux NFS Mailing List <linux-nfs@...r.kernel.org>, Linux API Mailing List <linux-api@...r.kernel.org> Subject: Re: [PATCH v8 10/41] richacl: Permission check algorithm On Mon, Sep 28, 2015 at 06:25:23PM +0200, Andreas Grünbacher wrote: > 2015-09-28 18:08 GMT+02:00 J. Bruce Fields <bfields@...ldses.org>: > > On Mon, Sep 28, 2015 at 12:09:01AM +0200, Andreas Gruenbacher wrote: > >> + /* > >> + * Check if the acl grants the requested access and determine which > >> + * file class the process is in. > >> + */ > >> + richacl_for_each_entry(ace, acl) { > >> + unsigned int ace_mask = ace->e_mask; > >> + > >> + if (richace_is_inherit_only(ace)) > >> + continue; > >> + if (richace_is_owner(ace)) { > >> + if (!uid_eq(current_fsuid(), inode->i_uid)) > >> + continue; > >> + goto entry_matches_owner; > >> + } else if (richace_is_group(ace)) { > >> + if (!in_owning_group) > >> + continue; > >> + } else if (richace_is_unix_user(ace)) { > >> + if (!uid_eq(current_fsuid(), ace->e_id.uid)) > >> + continue; > >> + goto entry_matches_owner; > >> + } else if (richace_is_unix_group(ace)) { > >> + if (!in_group_p(ace->e_id.gid)) > >> + continue; > >> + } else > >> + goto entry_matches_everyone; > >> + > >> + /* > >> + * Apply the group file mask to entries other than owner@ and > >> + * everyone@ or user entries matching the owner. > > > > The above also skips the following group_mask application on any unix > > group. > > Really? How does it do that? Sorry, I meant "unix user", not "unix group"! --b. -- To unsubscribe from this list: send the line "unsubscribe linux-ext4" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Powered by blists - more mailing lists