capabilities: remove a layer of conditional logic

Remove a layer of conditional logic to make the use of conditions
easier to read and analyse.

Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
Reviewed-by: Serge Hallyn <serge@hallyn.com>
Acked-by: James Morris <james.l.morris@oracle.com>
Acked-by: Kees Cook <keescook@chromium.org>
Okay-ished-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: James Morris <james.l.morris@oracle.com>

diff --git a/security/commoncap.c b/security/commoncap.c
index d7f0cbdf04c4706e077fbd1351cdbc2db6b8ab9a..eac70e2b400b36b8047c1ab7f9100be565a5e331 100644 (file)
--- a/security/commoncap.c
+++ b/security/commoncap.c
@@ -781,13 +781,12 @@ static inline bool nonroot_raised_pE(struct cred *cred, kuid_t root)
 {
        bool ret = false;
 
-       if (__cap_grew(effective, ambient, cred)) {
-               if (!__cap_full(effective, cred) ||
-                   !__is_eff(root, cred) || !__is_real(root, cred) ||
-                   !root_privileged()) {
-                       ret = true;
-               }
-       }
+       if (__cap_grew(effective, ambient, cred) &&
+           (!__cap_full(effective, cred) ||
+            !__is_eff(root, cred) ||
+            !__is_real(root, cred) ||
+            !root_privileged()))
+               ret = true;
        return ret;
 }
 
@@ -880,13 +879,11 @@ int cap_bprm_set_creds(struct linux_binprm *bprm)
 
        /* Check for privilege-elevated exec. */
        bprm->cap_elevated = 0;
-       if (is_setid) {
+       if (is_setid ||
+           (!__is_real(root_uid, new) &&
+            (effective ||
+             __cap_grew(permitted, ambient, new))))
                bprm->cap_elevated = 1;
-       } else if (!__is_real(root_uid, new)) {
-               if (effective ||
-                   __cap_grew(permitted, ambient, new))
-                       bprm->cap_elevated = 1;
-       }
 
        return 0;
 }