summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorAl Viro <viro@zeniv.linux.org.uk>2011-06-20 19:55:42 -0400
committerAl Viro <viro@zeniv.linux.org.uk>2011-07-20 01:43:30 -0400
commitd594e7ec4da6c1a527dea4965eee37cd785792b8 (patch)
treeb1c50c217309934a25449052625747927cbe4b45
parenteecdd358b467405a084d400d5ec571bbdbfe97a3 (diff)
massage generic_permission() to treat directories on a separate path
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
-rw-r--r--fs/namei.c17
1 files changed, 13 insertions, 4 deletions
diff --git a/fs/namei.c b/fs/namei.c
index 21eba95368f2..758bae739305 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -235,12 +235,21 @@ int generic_permission(struct inode *inode, int mask)
if (ret != -EACCES)
return ret;
+ if (S_ISDIR(inode->i_mode)) {
+ /* DACs are overridable for directories */
+ if (ns_capable(inode_userns(inode), CAP_DAC_OVERRIDE))
+ return 0;
+ if (!(mask & MAY_WRITE))
+ if (ns_capable(inode_userns(inode), CAP_DAC_READ_SEARCH))
+ return 0;
+ return -EACCES;
+ }
/*
* Read/write DACs are always overridable.
- * Executable DACs are overridable for all directories and
- * for non-directories that have least one exec bit set.
+ * Executable DACs are overridable when there is
+ * at least one exec bit set.
*/
- if (!(mask & MAY_EXEC) || execute_ok(inode))
+ if (!(mask & MAY_EXEC) || (inode->i_mode & S_IXUGO))
if (ns_capable(inode_userns(inode), CAP_DAC_OVERRIDE))
return 0;
@@ -248,7 +257,7 @@ int generic_permission(struct inode *inode, int mask)
* Searching includes executable on directories, else just read.
*/
mask &= MAY_READ | MAY_WRITE | MAY_EXEC;
- if (mask == MAY_READ || (S_ISDIR(inode->i_mode) && !(mask & MAY_WRITE)))
+ if (mask == MAY_READ)
if (ns_capable(inode_userns(inode), CAP_DAC_READ_SEARCH))
return 0;