diff options
| author | Max Krummenacher <max.krummenacher@toradex.com> | 2024-02-05 16:35:46 +0100 |
|---|---|---|
| committer | Max Krummenacher <max.krummenacher@toradex.com> | 2024-02-05 16:36:18 +0100 |
| commit | 340d0000d1e277a5ec64e5bd903dab8ed1df1860 (patch) | |
| tree | b785c59256937102b9f0011ef143b1cb40471b48 /security/keys/keyctl.c | |
| parent | 4f79a6f97a8b85a7f887723616825b2427e38059 (diff) | |
| parent | 16e6e107a688046df37976fb6d7310e886c8115d (diff) | |
Merge tag 'v5.4.264' into toradex_5.4.y
This is the 5.4.264 stable release
Conflicts:
drivers/pci/controller/dwc/pci-imx6.c
commit 0f31993721f92 ("PCI: imx6: Install the fault
handler only on compatible match") overlaps with our
not mainlined THUMB work.
Keep both additions
sound/soc/codecs/sgtl5000.c
commit c062676528865 (ASoC: sgtl5000: Reset the
CHIP_CLK_CTRL reg on remove") with a backport of a
"fixes" commit.
Diffstat (limited to 'security/keys/keyctl.c')
| -rw-r--r-- | security/keys/keyctl.c | 11 |
1 files changed, 8 insertions, 3 deletions
diff --git a/security/keys/keyctl.c b/security/keys/keyctl.c index edde63a63007..f42968f34958 100644 --- a/security/keys/keyctl.c +++ b/security/keys/keyctl.c @@ -977,14 +977,19 @@ long keyctl_chown_key(key_serial_t id, uid_t user, gid_t group) ret = -EACCES; down_write(&key->sem); - if (!capable(CAP_SYS_ADMIN)) { + { + bool is_privileged_op = false; + /* only the sysadmin can chown a key to some other UID */ if (user != (uid_t) -1 && !uid_eq(key->uid, uid)) - goto error_put; + is_privileged_op = true; /* only the sysadmin can set the key's GID to a group other * than one of those that the current process subscribes to */ if (group != (gid_t) -1 && !gid_eq(gid, key->gid) && !in_group_p(gid)) + is_privileged_op = true; + + if (is_privileged_op && !capable(CAP_SYS_ADMIN)) goto error_put; } @@ -1084,7 +1089,7 @@ long keyctl_setperm_key(key_serial_t id, key_perm_t perm) down_write(&key->sem); /* if we're not the sysadmin, we can only change a key that we own */ - if (capable(CAP_SYS_ADMIN) || uid_eq(key->uid, current_fsuid())) { + if (uid_eq(key->uid, current_fsuid()) || capable(CAP_SYS_ADMIN)) { key->perm = perm; ret = 0; } |