Re: [RFC PATCH 2/2] capability: use new capable_or functionality
From: Alexei Starovoitov <hidden>
Date: 2022-02-17 17:30:10
Also in:
bpf, linux-block, linux-fsdevel, linux-media, linux-s390, linux-security-module, lkml, selinux
On Thu, Feb 17, 2022 at 6:50 AM Christian Göttsche [off-list ref] wrote:
Use the new added capable_or macro in appropriate cases, where a task is required to have any of two capabilities. Reorder CAP_SYS_ADMIN last. TODO: split into subsystem patches.
Yes. Please. The bpf side picked the existing order because we were aware of that selinux issue. Looks like there is no good order that works for all. So the new helper makes a lot of sense.
Fixes: 94c4b4fd25e6 ("block: Check ADMIN before NICE for IOPRIO_CLASS_RT")