diff options
| author | NeilBrown <neilb@suse.com> | 2018-05-21 14:35:12 +1000 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2018-05-25 18:29:10 +0200 |
| commit | f497115d4cf8a430c5d9902ce35716ba5f9c21ef (patch) | |
| tree | 81943e7633cb50a334ca96c7a78b68fb6c47ad68 /drivers/staging/lustre/include | |
| parent | 63fd7d04580b6345ff1e0aab906c034f973d493e (diff) | |
| download | op-kernel-dev-f497115d4cf8a430c5d9902ce35716ba5f9c21ef.zip op-kernel-dev-f497115d4cf8a430c5d9902ce35716ba5f9c21ef.tar.gz | |
staging: lustre: simplify capability dropping.
Lustre has a 'squash credentials' concept similar to the "anon_uid"
for nfsd. When accessing a file with squashed credentials, we
need to also drop capabilities.
Linux has cap_drop_fs_set() and cap_drop_nfsd_set(). Rather than
taking a completely different approach, this patch changes lustre
to use this same cap_drop_*_set() approach.
With this change we also drop CAP_MKNOD and CAP_MAC_OVERRIDE
which are probably appropriate, and don't drop
CAP_SYS_ADMIN or CAP_SYS_BOOT which should be irrelevant for
file permission checking
Calling both cap_drop_*_set() seems a bit clumsy, but gets
the job done.
Signed-off-by: NeilBrown <neilb@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/staging/lustre/include')
| -rw-r--r-- | drivers/staging/lustre/include/linux/libcfs/curproc.h | 10 |
1 files changed, 0 insertions, 10 deletions
diff --git a/drivers/staging/lustre/include/linux/libcfs/curproc.h b/drivers/staging/lustre/include/linux/libcfs/curproc.h index 83526f8..fc6f6eb 100644 --- a/drivers/staging/lustre/include/linux/libcfs/curproc.h +++ b/drivers/staging/lustre/include/linux/libcfs/curproc.h @@ -50,16 +50,6 @@ typedef u32 cfs_cap_t; -#define CFS_CAP_FS_MASK (BIT(CAP_CHOWN) | \ - BIT(CAP_DAC_OVERRIDE) | \ - BIT(CAP_DAC_READ_SEARCH) | \ - BIT(CAP_FOWNER) | \ - BIT(CAP_FSETID) | \ - BIT(CAP_LINUX_IMMUTABLE) | \ - BIT(CAP_SYS_ADMIN) | \ - BIT(CAP_SYS_BOOT) | \ - BIT(CAP_SYS_RESOURCE)) - static inline cfs_cap_t cfs_curproc_cap_pack(void) { /* cfs_cap_t is only the first word of kernel_cap_t */ |
