linux-kernel - RE: [PATCH] block: Check ADMIN before NICE for IOPRIO_CLASS

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <43aeb7451621474ea0d7bee6b99039c3@AcuMS.aculab.com>
Date:   Tue, 16 Nov 2021 09:30:12 +0000
From:   David Laight <David.Laight@...LAB.COM>
To:     'Alistair Delva' <adelva@...gle.com>,
        Ondrej Mosnacek <omosnace@...hat.com>
CC:     Linux kernel mailing list <linux-kernel@...r.kernel.org>,
        "Khazhismel Kumykov" <khazhy@...gle.com>,
        Bart Van Assche <bvanassche@....org>,
        "Serge Hallyn" <serge@...lyn.com>, Jens Axboe <axboe@...nel.dk>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        Paul Moore <paul@...l-moore.com>,
        SElinux list <selinux@...r.kernel.org>,
        Linux Security Module list 
        <linux-security-module@...r.kernel.org>,
        "Cc: Android Kernel" <kernel-team@...roid.com>,
        Linux Stable maillist <stable@...r.kernel.org>
Subject: RE: [PATCH] block: Check ADMIN before NICE for IOPRIO_CLASS_RT

From: Alistair Delva
> Sent: 15 November 2021 19:09
...
> > > -                       if (!capable(CAP_SYS_NICE) && !capable(CAP_SYS_ADMIN))
> > > +                       if (!capable(CAP_SYS_ADMIN) && !capable(CAP_SYS_NICE))
> > >                                 return -EPERM;

Isn't the real problem that you actually want to test:
		if (!capable(CAP_SYS_NICE | CAP_SYS_ADMIN))
			return -EPERM;
so that you only get the fail 'splat' when neither is set.

This will be true whenever more than one capability enables something.

Possibly this needs something like:
int capabale_or(unsigned int, ...);
#define capabale_or(...) capabable_or(__VA_LIST__, ~0u)

	David

-
Registered Address Lakeside, Bramley Road, Mount Farm, Milton Keynes, MK1 1PT, UK
Registration No: 1397386 (Wales)