security: Use user_namespace::level to avoid redundant iterations in cap_capable()
When ns->level is not larger then cred->user_ns->level, then ns can't be cred->user_ns's descendant, and there is no a sense to search in parents. So, break the cycle earlier and skip needless iterations. v2: Change comment on suggested by Andy Lutomirski. Signed-off-by:Kirill Tkhai <ktkhai@virtuozzo.com> Signed-off-by:
Eric W. Biederman <ebiederm@xmission.com>
parent
a2b42626
Please register or sign in to comment