summaryrefslogtreecommitdiffstats
path: root/fs/inode.c
diff options
context:
space:
mode:
authorEric W. Biederman <ebiederm@xmission.com>2011-11-14 16:24:06 -0800
committerEric W. Biederman <ebiederm@xmission.com>2012-04-07 17:02:46 -0700
commit1a48e2ac034d47ed843081c4523b63c46b46888b (patch)
treed3a32ac7ffc47b075a64701a2fd74e00bbccf84d /fs/inode.c
parent973c5914260d75292f71a4729753086b9e863d57 (diff)
downloadlinux-1a48e2ac034d47ed843081c4523b63c46b46888b.tar.gz
linux-1a48e2ac034d47ed843081c4523b63c46b46888b.tar.bz2
linux-1a48e2ac034d47ed843081c4523b63c46b46888b.zip
userns: Replace the hard to write inode_userns with inode_capable.
This represents a change in strategy of how to handle user namespaces. Instead of tagging everything explicitly with a user namespace and bulking up all of the comparisons of uids and gids in the kernel, all uids and gids in use will have a mapping to a flat kuid and kgid spaces respectively. This allows much more of the existing logic to be preserved and in general allows for faster code. In this new and improved world we allow someone to utiliize capabilities over an inode if the inodes owner mapps into the capabilities holders user namespace and the user has capabilities in their user namespace. Which is simple and efficient. Moving the fs uid comparisons to be comparisons in a flat kuid space follows in later patches, something that is only significant if you are using user namespaces. Acked-by: Serge Hallyn <serge.hallyn@canonical.com> Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>
Diffstat (limited to 'fs/inode.c')
-rw-r--r--fs/inode.c6
1 files changed, 2 insertions, 4 deletions
diff --git a/fs/inode.c b/fs/inode.c
index 9f4f5fecc096..f0c4ace408e4 100644
--- a/fs/inode.c
+++ b/fs/inode.c
@@ -1732,11 +1732,9 @@ EXPORT_SYMBOL(inode_init_owner);
*/
bool inode_owner_or_capable(const struct inode *inode)
{
- struct user_namespace *ns = inode_userns(inode);
-
- if (current_user_ns() == ns && current_fsuid() == inode->i_uid)
+ if (current_fsuid() == inode->i_uid)
return true;
- if (ns_capable(ns, CAP_FOWNER))
+ if (inode_capable(inode, CAP_FOWNER))
return true;
return false;
}