Lines Matching refs:new
231 * @new: The proposed new credentials; alterations should be made here
233 * @effective: A pointer to the proposed new effective capabilities set
234 * @inheritable: A pointer to the proposed new inheritable capabilities set
235 * @permitted: A pointer to the proposed new permitted capabilities set
238 * process's capability sets. The changes are made to the proposed new
241 int cap_capset(struct cred *new,
257 /* no new pI capabilities outside bounding set */
260 /* verify restrictions on target's new Permitted set */
268 new->cap_effective = *effective;
269 new->cap_inheritable = *inheritable;
270 new->cap_permitted = *permitted;
276 new->cap_ambient = cap_intersect(new->cap_ambient,
279 if (WARN_ON(!cap_ambient_invariant_ok(new)))
495 * If all is ok, we return the new size, on error return < 0.
546 * Calculate the new process capability sets from the capability sets attached
554 struct cred *new = bprm->cred;
572 new->cap_permitted.cap[i] =
573 (new->cap_bset.cap[i] & permitted) |
574 (new->cap_inheritable.cap[i] & inheritable);
576 if (permitted & ~new->cap_permitted.cap[i])
739 struct cred *new = bprm->cred;
748 if (has_fcap && __is_suid(root_uid, new)) {
757 if (__is_eff(root_uid, new) || __is_real(root_uid, new)) {
759 new->cap_permitted = cap_combine(old->cap_bset,
765 if (__is_eff(root_uid, new))
776 static inline bool __is_setuid(struct cred *new, const struct cred *old)
777 { return !uid_eq(new->euid, old->uid); }
779 static inline bool __is_setgid(struct cred *new, const struct cred *old)
780 { return !gid_eq(new->egid, old->gid); }
799 static inline bool nonroot_raised_pE(struct cred *new, const struct cred *old,
804 if ((__cap_grew(effective, ambient, new) &&
805 !(__cap_full(effective, new) &&
806 (__is_eff(root, new) || __is_real(root, new)) &&
809 __is_suid(root, new) &&
810 !__cap_full(effective, new)) ||
811 (!__is_setuid(new, old) &&
813 __cap_gained(permitted, new, old)) ||
814 __cap_gained(ambient, new, old))))
826 * Set up the proposed credentials for a new execution context being
834 struct cred *new = bprm->cred;
846 root_uid = make_kuid(new->user_ns, 0);
851 if (__cap_gained(permitted, new, old))
857 * In addition, if NO_NEW_PRIVS, then ensure we get no new privs.
859 is_setid = __is_setuid(new, old) || __is_setgid(new, old);
861 if ((is_setid || __cap_gained(permitted, new, old)) &&
863 !ptracer_capable(current, new->user_ns))) {
865 if (!ns_capable(new->user_ns, CAP_SETUID) ||
867 new->euid = new->uid;
868 new->egid = new->gid;
870 new->cap_permitted = cap_intersect(new->cap_permitted,
874 new->suid = new->fsuid = new->euid;
875 new->sgid = new->fsgid = new->egid;
879 cap_clear(new->cap_ambient);
885 new->cap_permitted = cap_combine(new->cap_permitted, new->cap_ambient);
892 new->cap_effective = new->cap_permitted;
894 new->cap_effective = new->cap_ambient;
896 if (WARN_ON(!cap_ambient_invariant_ok(new)))
899 if (nonroot_raised_pE(new, old, root_uid, has_fcap)) {
900 ret = audit_log_bprm_fcaps(bprm, new, old);
905 new->securebits &= ~issecure_mask(SECURE_KEEP_CAPS);
907 if (WARN_ON(!cap_ambient_invariant_ok(new)))
912 (!__is_real(root_uid, new) &&
914 __cap_grew(permitted, ambient, new))))
1020 static inline void cap_emulate_setxuid(struct cred *new, const struct cred *old)
1027 (!uid_eq(new->uid, root_uid) &&
1028 !uid_eq(new->euid, root_uid) &&
1029 !uid_eq(new->suid, root_uid))) {
1031 cap_clear(new->cap_permitted);
1032 cap_clear(new->cap_effective);
1040 cap_clear(new->cap_ambient);
1042 if (uid_eq(old->euid, root_uid) && !uid_eq(new->euid, root_uid))
1043 cap_clear(new->cap_effective);
1044 if (!uid_eq(old->euid, root_uid) && uid_eq(new->euid, root_uid))
1045 new->cap_effective = new->cap_permitted;
1050 * @new: The proposed credentials
1057 int cap_task_fix_setuid(struct cred *new, const struct cred *old, int flags)
1066 cap_emulate_setxuid(new, old);
1078 if (uid_eq(old->fsuid, root_uid) && !uid_eq(new->fsuid, root_uid))
1079 new->cap_effective =
1080 cap_drop_fs_set(new->cap_effective);
1082 if (!uid_eq(old->fsuid, root_uid) && uid_eq(new->fsuid, root_uid))
1083 new->cap_effective =
1084 cap_raise_fs_set(new->cap_effective,
1085 new->cap_permitted);
1164 struct cred *new;
1171 new = prepare_creds();
1172 if (!new)
1174 cap_lower(new->cap_bset, cap);
1175 return commit_creds(new);
1194 struct cred *new;
1244 new = prepare_creds();
1245 if (!new)
1247 new->securebits = arg2;
1248 return commit_creds(new);
1262 new = prepare_creds();
1263 if (!new)
1266 new->securebits |= issecure_mask(SECURE_KEEP_CAPS);
1268 new->securebits &= ~issecure_mask(SECURE_KEEP_CAPS);
1269 return commit_creds(new);
1276 new = prepare_creds();
1277 if (!new)
1279 cap_clear(new->cap_ambient);
1280 return commit_creds(new);
1299 new = prepare_creds();
1300 if (!new)
1303 cap_raise(new->cap_ambient, arg3);
1305 cap_lower(new->cap_ambient, arg3);
1306 return commit_creds(new);
1316 * cap_vm_enough_memory - Determine whether a new virtual mapping is permitted
1317 * @mm: The VM space in which the new mapping is to be made
1320 * Determine whether the allocation of a new virtual mapping by the current