242 int cap_capset(struct cred *new,  in cap_capset()  argument
269 	new->cap_effective   = *effective;  in cap_capset()
270 	new->cap_inheritable = *inheritable;  in cap_capset()
271 	new->cap_permitted   = *permitted;  in cap_capset()
277 	new->cap_ambient = cap_intersect(new->cap_ambient,  in cap_capset()
280 	if (WARN_ON(!cap_ambient_invariant_ok(new)))  in cap_capset()
591 	struct cred *new = bprm->cred;  in bprm_caps_from_vfs_caps()  local
604 	new->cap_permitted.val =  in bprm_caps_from_vfs_caps()
605 		(new->cap_bset.val & caps->permitted.val) |  in bprm_caps_from_vfs_caps()
606 		(new->cap_inheritable.val & caps->inheritable.val);  in bprm_caps_from_vfs_caps()
608 	if (caps->permitted.val & ~new->cap_permitted.val)  in bprm_caps_from_vfs_caps()
792 	struct cred *new = bprm->cred;  in handle_privileged_root()  local
801 	if (has_fcap && __is_suid(root_uid, new)) {  in handle_privileged_root()
810 	if (__is_eff(root_uid, new) || __is_real(root_uid, new)) {  in handle_privileged_root()
812 		new->cap_permitted = cap_combine(old->cap_bset,  in handle_privileged_root()
818 	if (__is_eff(root_uid, new))  in handle_privileged_root()
829 static inline bool __is_setuid(struct cred *new, const struct cred *old)  in __is_setuid()  argument
830 { return !uid_eq(new->euid, old->uid); }  in __is_setuid()
832 static inline bool __is_setgid(struct cred *new, const struct cred *old)  in __is_setgid()  argument
833 { return !gid_eq(new->egid, old->gid); }  in __is_setgid()
852 static inline bool nonroot_raised_pE(struct cred *new, const struct cred *old,  in nonroot_raised_pE()  argument
857 	if ((__cap_grew(effective, ambient, new) &&  in nonroot_raised_pE()
858 	     !(__cap_full(effective, new) &&  in nonroot_raised_pE()
859 	       (__is_eff(root, new) || __is_real(root, new)) &&  in nonroot_raised_pE()
862 	     __is_suid(root, new) &&  in nonroot_raised_pE()
863 	     !__cap_full(effective, new)) ||  in nonroot_raised_pE()
864 	    (!__is_setuid(new, old) &&  in nonroot_raised_pE()
866 	       __cap_gained(permitted, new, old)) ||  in nonroot_raised_pE()
867 	      __cap_gained(ambient, new, old))))  in nonroot_raised_pE()
889 	struct cred *new = bprm->cred;  in cap_bprm_creds_from_file()  local
901 	root_uid = make_kuid(new->user_ns, 0);  in cap_bprm_creds_from_file()
906 	if (__cap_gained(permitted, new, old))  in cap_bprm_creds_from_file()
914 	is_setid = __is_setuid(new, old) || __is_setgid(new, old);  in cap_bprm_creds_from_file()
916 	if ((is_setid || __cap_gained(permitted, new, old)) &&  in cap_bprm_creds_from_file()
918 	     !ptracer_capable(current, new->user_ns))) {  in cap_bprm_creds_from_file()
920 		if (!ns_capable(new->user_ns, CAP_SETUID) ||  in cap_bprm_creds_from_file()
922 			new->euid = new->uid;  in cap_bprm_creds_from_file()
923 			new->egid = new->gid;  in cap_bprm_creds_from_file()
925 		new->cap_permitted = cap_intersect(new->cap_permitted,  in cap_bprm_creds_from_file()
929 	new->suid = new->fsuid = new->euid;  in cap_bprm_creds_from_file()
930 	new->sgid = new->fsgid = new->egid;  in cap_bprm_creds_from_file()
934 		cap_clear(new->cap_ambient);  in cap_bprm_creds_from_file()
940 	new->cap_permitted = cap_combine(new->cap_permitted, new->cap_ambient);  in cap_bprm_creds_from_file()
947 		new->cap_effective = new->cap_permitted;  in cap_bprm_creds_from_file()
949 		new->cap_effective = new->cap_ambient;  in cap_bprm_creds_from_file()
951 	if (WARN_ON(!cap_ambient_invariant_ok(new)))  in cap_bprm_creds_from_file()
954 	if (nonroot_raised_pE(new, old, root_uid, has_fcap)) {  in cap_bprm_creds_from_file()
955 		ret = audit_log_bprm_fcaps(bprm, new, old);  in cap_bprm_creds_from_file()
960 	new->securebits &= ~issecure_mask(SECURE_KEEP_CAPS);  in cap_bprm_creds_from_file()
962 	if (WARN_ON(!cap_ambient_invariant_ok(new)))  in cap_bprm_creds_from_file()
967 	    (!__is_real(root_uid, new) &&  in cap_bprm_creds_from_file()
969 	      __cap_grew(permitted, ambient, new))))  in cap_bprm_creds_from_file()
1084 static inline void cap_emulate_setxuid(struct cred *new, const struct cred *old)  in cap_emulate_setxuid()  argument
1091 	    (!uid_eq(new->uid, root_uid) &&  in cap_emulate_setxuid()
1092 	     !uid_eq(new->euid, root_uid) &&  in cap_emulate_setxuid()
1093 	     !uid_eq(new->suid, root_uid))) {  in cap_emulate_setxuid()
1095 			cap_clear(new->cap_permitted);  in cap_emulate_setxuid()
1096 			cap_clear(new->cap_effective);  in cap_emulate_setxuid()
1104 		cap_clear(new->cap_ambient);  in cap_emulate_setxuid()
1106 	if (uid_eq(old->euid, root_uid) && !uid_eq(new->euid, root_uid))  in cap_emulate_setxuid()
1107 		cap_clear(new->cap_effective);  in cap_emulate_setxuid()
1108 	if (!uid_eq(old->euid, root_uid) && uid_eq(new->euid, root_uid))  in cap_emulate_setxuid()
1109 		new->cap_effective = new->cap_permitted;  in cap_emulate_setxuid()
1123 int cap_task_fix_setuid(struct cred *new, const struct cred *old, int flags)  in cap_task_fix_setuid()  argument
1132 			cap_emulate_setxuid(new, old);  in cap_task_fix_setuid()
1144 			if (uid_eq(old->fsuid, root_uid) && !uid_eq(new->fsuid, root_uid))  in cap_task_fix_setuid()
1145 				new->cap_effective =  in cap_task_fix_setuid()
1146 					cap_drop_fs_set(new->cap_effective);  in cap_task_fix_setuid()
1148 			if (!uid_eq(old->fsuid, root_uid) && uid_eq(new->fsuid, root_uid))  in cap_task_fix_setuid()
1149 				new->cap_effective =  in cap_task_fix_setuid()
1150 					cap_raise_fs_set(new->cap_effective,  in cap_task_fix_setuid()
1151 							 new->cap_permitted);  in cap_task_fix_setuid()
1236 	struct cred *new;  in cap_prctl_drop()  local
1243 	new = prepare_creds();  in cap_prctl_drop()
1244 	if (!new)  in cap_prctl_drop()
1246 	cap_lower(new->cap_bset, cap);  in cap_prctl_drop()
1247 	return commit_creds(new);  in cap_prctl_drop()
1269 	struct cred *new;  in cap_task_prctl()  local
1319 		new = prepare_creds();  in cap_task_prctl()
1320 		if (!new)  in cap_task_prctl()
1322 		new->securebits = arg2;  in cap_task_prctl()
1323 		return commit_creds(new);  in cap_task_prctl()
1337 		new = prepare_creds();  in cap_task_prctl()
1338 		if (!new)  in cap_task_prctl()
1341 			new->securebits |= issecure_mask(SECURE_KEEP_CAPS);  in cap_task_prctl()
1343 			new->securebits &= ~issecure_mask(SECURE_KEEP_CAPS);  in cap_task_prctl()
1344 		return commit_creds(new);  in cap_task_prctl()
1351 			new = prepare_creds();  in cap_task_prctl()
1352 			if (!new)  in cap_task_prctl()
1354 			cap_clear(new->cap_ambient);  in cap_task_prctl()
1355 			return commit_creds(new);  in cap_task_prctl()
1374 			new = prepare_creds();  in cap_task_prctl()
1375 			if (!new)  in cap_task_prctl()
1378 				cap_raise(new->cap_ambient, arg3);  in cap_task_prctl()
1380 				cap_lower(new->cap_ambient, arg3);  in cap_task_prctl()
1381 			return commit_creds(new);  in cap_task_prctl()