Give the LSM framework the ability to filter setgroups() syscalls. There
are already analagous hooks for the set*uid() and set*gid() syscalls.
The SafeSetID LSM will use this new hook to ensure setgroups() calls are
allowed by the installed security policy.
Signed-off-by: Micah Morton <[email protected]>
---
Developed on 5.18
include/linux/lsm_hook_defs.h | 1 +
include/linux/lsm_hooks.h | 7 +++++++
include/linux/security.h | 7 +++++++
kernel/groups.c | 12 ++++++++++++
security/security.c | 5 +++++
5 files changed, 32 insertions(+)
diff --git a/include/linux/lsm_hook_defs.h b/include/linux/lsm_hook_defs.h
index db924fe379c9..c01063ec4be7 100644
--- a/include/linux/lsm_hook_defs.h
+++ b/include/linux/lsm_hook_defs.h
@@ -201,6 +201,7 @@ LSM_HOOK(int, 0, task_fix_setuid, struct cred *new, const struct cred *old,
int flags)
LSM_HOOK(int, 0, task_fix_setgid, struct cred *new, const struct cred * old,
int flags)
+LSM_HOOK(int, 0, task_fix_setgroups, struct cred *new, const struct cred * old)
LSM_HOOK(int, 0, task_setpgid, struct task_struct *p, pid_t pgid)
LSM_HOOK(int, 0, task_getpgid, struct task_struct *p)
LSM_HOOK(int, 0, task_getsid, struct task_struct *p)
diff --git a/include/linux/lsm_hooks.h b/include/linux/lsm_hooks.h
index 419b5febc3ca..b5143d9a1127 100644
--- a/include/linux/lsm_hooks.h
+++ b/include/linux/lsm_hooks.h
@@ -701,6 +701,13 @@
* @old is the set of credentials that are being replaced.
* @flags contains one of the LSM_SETID_* values.
* Return 0 on success.
+ * @task_fix_setgroups:
+ * Update the module's state after setting the supplementary group
+ * identity attributes of the current process.
+ * @new is the set of credentials that will be installed. Modifications
+ * should be made to this rather than to @current->cred.
+ * @old is the set of credentials that are being replaced.
+ * Return 0 on success.
* @task_setpgid:
* Check permission before setting the process group identifier of the
* process @p to @pgid.
diff --git a/include/linux/security.h b/include/linux/security.h
index 25b3ef71f495..d111ff830742 100644
--- a/include/linux/security.h
+++ b/include/linux/security.h
@@ -413,6 +413,7 @@ int security_task_fix_setuid(struct cred *new, const struct cred *old,
int flags);
int security_task_fix_setgid(struct cred *new, const struct cred *old,
int flags);
+int security_task_fix_setgroups(struct cred *new, const struct cred *old);
int security_task_setpgid(struct task_struct *p, pid_t pgid);
int security_task_getpgid(struct task_struct *p);
int security_task_getsid(struct task_struct *p);
@@ -1096,6 +1097,12 @@ static inline int security_task_fix_setgid(struct cred *new,
return 0;
}
+static inline int security_task_fix_setgroups(struct cred *new,
+ const struct cred *old)
+{
+ return 0;
+}
+
static inline int security_task_setpgid(struct task_struct *p, pid_t pgid)
{
return 0;
diff --git a/kernel/groups.c b/kernel/groups.c
index 787b381c7c00..c085f54d8dbb 100644
--- a/kernel/groups.c
+++ b/kernel/groups.c
@@ -134,13 +134,25 @@ EXPORT_SYMBOL(set_groups);
int set_current_groups(struct group_info *group_info)
{
struct cred *new;
+ struct cred *old;
new = prepare_creds();
if (!new)
return -ENOMEM;
+ old = current_cred();
+
set_groups(new, group_info);
+
+ retval = security_task_fix_setgroups(new, old);
+ if (retval < 0)
+ goto error;
+
return commit_creds(new);
+
+error:
+ abort_creds(new);
+ return retval;
}
EXPORT_SYMBOL(set_current_groups);
diff --git a/security/security.c b/security/security.c
index b7cf5cbfdc67..eaed8d16d90a 100644
--- a/security/security.c
+++ b/security/security.c
@@ -1809,6 +1809,11 @@ int security_task_fix_setgid(struct cred *new, const struct cred *old,
return call_int_hook(task_fix_setgid, 0, new, old, flags);
}
+int security_task_fix_setgroups(struct cred *new, const struct cred *old)
+{
+ return call_int_hook(task_fix_setgroups, 0, new, old);
+}
+
int security_task_setpgid(struct task_struct *p, pid_t pgid)
{
return call_int_hook(task_setpgid, 0, p, pgid);
--
2.36.1.476.g0c4daa206d-goog
Hi Micah,
I love your patch! Yet something to improve:
[auto build test ERROR on linus/master]
[also build test ERROR on jmorris-security/next-testing kees/for-next/pstore v5.19-rc2 next-20220610]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch]
url: https://github.com/intel-lab-lkp/linux/commits/Micah-Morton/security-Add-LSM-hook-to-setgroups-syscall/20220614-050341
base: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git b13baccc3850ca8b8cccbf8ed9912dbaa0fdf7f3
config: um-i386_defconfig (https://download.01.org/0day-ci/archive/20220614/[email protected]/config)
compiler: gcc-11 (Debian 11.3.0-3) 11.3.0
reproduce (this is a W=1 build):
# https://github.com/intel-lab-lkp/linux/commit/b21cba6f759a2a60439de4d0f85323ed745b3ade
git remote add linux-review https://github.com/intel-lab-lkp/linux
git fetch --no-tags linux-review Micah-Morton/security-Add-LSM-hook-to-setgroups-syscall/20220614-050341
git checkout b21cba6f759a2a60439de4d0f85323ed745b3ade
# save the config file
mkdir build_dir && cp config build_dir/.config
make W=1 O=build_dir ARCH=um SUBARCH=i386 SHELL=/bin/bash
If you fix the issue, kindly add following tag where applicable
Reported-by: kernel test robot <[email protected]>
All error/warnings (new ones prefixed by >>):
kernel/groups.c: In function 'set_current_groups':
>> kernel/groups.c:143:13: warning: assignment discards 'const' qualifier from pointer target type [-Wdiscarded-qualifiers]
143 | old = current_cred();
| ^
>> kernel/groups.c:147:9: error: 'retval' undeclared (first use in this function)
147 | retval = security_task_fix_setgroups(new, old);
| ^~~~~~
kernel/groups.c:147:9: note: each undeclared identifier is reported only once for each function it appears in
vim +/retval +147 kernel/groups.c
126
127 /**
128 * set_current_groups - Change current's group subscription
129 * @group_info: The group list to impose
130 *
131 * Validate a group subscription and, if valid, impose it upon current's task
132 * security record.
133 */
134 int set_current_groups(struct group_info *group_info)
135 {
136 struct cred *new;
137 struct cred *old;
138
139 new = prepare_creds();
140 if (!new)
141 return -ENOMEM;
142
> 143 old = current_cred();
144
145 set_groups(new, group_info);
146
> 147 retval = security_task_fix_setgroups(new, old);
148 if (retval < 0)
149 goto error;
150
151 return commit_creds(new);
152
153 error:
154 abort_creds(new);
155 return retval;
156 }
157
--
0-DAY CI Kernel Test Service
https://01.org/lkp
Hi Micah,
I love your patch! Yet something to improve:
[auto build test ERROR on linus/master]
[also build test ERROR on kees/for-next/pstore v5.19-rc2 next-20220610]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch]
url: https://github.com/intel-lab-lkp/linux/commits/Micah-Morton/security-Add-LSM-hook-to-setgroups-syscall/20220614-050341
base: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git b13baccc3850ca8b8cccbf8ed9912dbaa0fdf7f3
config: hexagon-randconfig-r045-20220613 (https://download.01.org/0day-ci/archive/20220614/[email protected]/config)
compiler: clang version 15.0.0 (https://github.com/llvm/llvm-project c97436f8b6e2718286e8496faf53a2c800e281cf)
reproduce (this is a W=1 build):
wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross
chmod +x ~/bin/make.cross
# https://github.com/intel-lab-lkp/linux/commit/b21cba6f759a2a60439de4d0f85323ed745b3ade
git remote add linux-review https://github.com/intel-lab-lkp/linux
git fetch --no-tags linux-review Micah-Morton/security-Add-LSM-hook-to-setgroups-syscall/20220614-050341
git checkout b21cba6f759a2a60439de4d0f85323ed745b3ade
# save the config file
mkdir build_dir && cp config build_dir/.config
COMPILER_INSTALL_PATH=$HOME/0day COMPILER=clang make.cross W=1 O=build_dir ARCH=hexagon SHELL=/bin/bash
If you fix the issue, kindly add following tag where applicable
Reported-by: kernel test robot <[email protected]>
All errors (new ones prefixed by >>):
>> kernel/groups.c:143:6: error: assigning to 'struct cred *' from 'typeof (*((__current_thread_info->task)->cred)) *' (aka 'const struct cred *') discards qualifiers [-Werror,-Wincompatible-pointer-types-discards-qualifiers]
old = current_cred();
^ ~~~~~~~~~~~~~~
>> kernel/groups.c:147:2: error: use of undeclared identifier 'retval'
retval = security_task_fix_setgroups(new, old);
^
kernel/groups.c:148:6: error: use of undeclared identifier 'retval'
if (retval < 0)
^
kernel/groups.c:155:9: error: use of undeclared identifier 'retval'
return retval;
^
4 errors generated.
vim +143 kernel/groups.c
126
127 /**
128 * set_current_groups - Change current's group subscription
129 * @group_info: The group list to impose
130 *
131 * Validate a group subscription and, if valid, impose it upon current's task
132 * security record.
133 */
134 int set_current_groups(struct group_info *group_info)
135 {
136 struct cred *new;
137 struct cred *old;
138
139 new = prepare_creds();
140 if (!new)
141 return -ENOMEM;
142
> 143 old = current_cred();
144
145 set_groups(new, group_info);
146
> 147 retval = security_task_fix_setgroups(new, old);
148 if (retval < 0)
149 goto error;
150
151 return commit_creds(new);
152
153 error:
154 abort_creds(new);
155 return retval;
156 }
157
--
0-DAY CI Kernel Test Service
https://01.org/lkp
Hi Micah,
I love your patch! Yet something to improve:
[auto build test ERROR on linus/master]
[also build test ERROR on jmorris-security/next-testing kees/for-next/pstore v5.19-rc2 next-20220614]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch]
url: https://github.com/intel-lab-lkp/linux/commits/Micah-Morton/security-Add-LSM-hook-to-setgroups-syscall/20220614-050341
base: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git b13baccc3850ca8b8cccbf8ed9912dbaa0fdf7f3
config: x86_64-randconfig-a002-20220613 (https://download.01.org/0day-ci/archive/20220614/[email protected]/config)
compiler: clang version 15.0.0 (https://github.com/llvm/llvm-project c97436f8b6e2718286e8496faf53a2c800e281cf)
reproduce (this is a W=1 build):
wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross
chmod +x ~/bin/make.cross
# https://github.com/intel-lab-lkp/linux/commit/b21cba6f759a2a60439de4d0f85323ed745b3ade
git remote add linux-review https://github.com/intel-lab-lkp/linux
git fetch --no-tags linux-review Micah-Morton/security-Add-LSM-hook-to-setgroups-syscall/20220614-050341
git checkout b21cba6f759a2a60439de4d0f85323ed745b3ade
# save the config file
mkdir build_dir && cp config build_dir/.config
COMPILER_INSTALL_PATH=$HOME/0day COMPILER=clang make.cross W=1 O=build_dir ARCH=x86_64 SHELL=/bin/bash
If you fix the issue, kindly add following tag where applicable
Reported-by: kernel test robot <[email protected]>
All errors (new ones prefixed by >>):
>> kernel/groups.c:143:6: error: assigning to 'struct cred *' from 'typeof (*(get_current()->cred)) *' (aka 'const struct cred *') discards qualifiers [-Werror,-Wincompatible-pointer-types-discards-qualifiers]
old = current_cred();
^ ~~~~~~~~~~~~~~
>> kernel/groups.c:147:2: error: use of undeclared identifier 'retval'
retval = security_task_fix_setgroups(new, old);
^
kernel/groups.c:148:6: error: use of undeclared identifier 'retval'
if (retval < 0)
^
kernel/groups.c:155:9: error: use of undeclared identifier 'retval'
return retval;
^
4 errors generated.
vim +143 kernel/groups.c
126
127 /**
128 * set_current_groups - Change current's group subscription
129 * @group_info: The group list to impose
130 *
131 * Validate a group subscription and, if valid, impose it upon current's task
132 * security record.
133 */
134 int set_current_groups(struct group_info *group_info)
135 {
136 struct cred *new;
137 struct cred *old;
138
139 new = prepare_creds();
140 if (!new)
141 return -ENOMEM;
142
> 143 old = current_cred();
144
145 set_groups(new, group_info);
146
> 147 retval = security_task_fix_setgroups(new, old);
148 if (retval < 0)
149 goto error;
150
151 return commit_creds(new);
152
153 error:
154 abort_creds(new);
155 return retval;
156 }
157
--
0-DAY CI Kernel Test Service
https://01.org/lkp
On Tue, 14 Jun 2022, kernel test robot wrote:
> Hi Micah,
>
> I love your patch! Yet something to improve:
>
> [auto build test ERROR on linus/master]
> [also build test ERROR on jmorris-security/next-testing kees/for-next/pstore v5.19-rc2 next-20220614]
My next-testing is out of date, I'll push a newer version.
--
James Morris
<[email protected]>