Clean up the sys_capset codepath a bit to account for the fact
that you can now not ever, never, capset on another task.
Signed-off-by: Serge E. Hallyn <serue@us.ibm.com>
---
kernel/capability.c | 83 +++++++++++++++++++-------------------------------
1 files changed, 32 insertions(+), 51 deletions(-)
diff --git a/kernel/capability.c b/kernel/capability.c
index d39c989..92dd85b 100644
--- a/kernel/capability.c
+++ b/kernel/capability.c
@@ -132,46 +132,31 @@ static int cap_validate_magic(cap_user_header_t header, unsigned *tocopy)
* process. The net result is that we can limit our use of locks to
* when we are reading the caps of another process.
*/
-static inline int cap_get_target_pid(pid_t pid, kernel_cap_t *pEp,
+static int cap_get_target_pid(pid_t pid, kernel_cap_t *pEp,
kernel_cap_t *pIp, kernel_cap_t *pPp)
{
int ret;
+ struct task_struct *target;
- if (pid && (pid != task_pid_vnr(current))) {
- struct task_struct *target;
+ if (!pid || pid == task_pid_vnr(current))
+ return security_capget(current, pEp, pIp, pPp);
- spin_lock(&task_capability_lock);
- read_lock(&tasklist_lock);
+ spin_lock(&task_capability_lock);
+ read_lock(&tasklist_lock);
- target = find_task_by_vpid(pid);
- if (!target)
- ret = -ESRCH;
- else
- ret = security_capget(target, pEp, pIp, pPp);
+ target = find_task_by_vpid(pid);
+ if (!target)
+ ret = -ESRCH;
+ else
+ ret = security_capget(target, pEp, pIp, pPp);
- read_unlock(&tasklist_lock);
- spin_unlock(&task_capability_lock);
- } else
- ret = security_capget(current, pEp, pIp, pPp);
+ read_unlock(&tasklist_lock);
+ spin_unlock(&task_capability_lock);
return ret;
}
/*
- * With filesystem capability support configured, the kernel does not
- * permit the changing of capabilities in one process by another
- * process. (CAP_SETPCAP has much less broad semantics when configured
- * this way.)
- */
-static inline int do_sys_capset_other_tasks(pid_t pid,
- ...
