Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753738AbdGSJ0y (ORCPT ); Wed, 19 Jul 2017 05:26:54 -0400 Received: from namei.org ([65.99.196.166]:39659 "EHLO namei.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753404AbdGSJ0t (ORCPT ); Wed, 19 Jul 2017 05:26:49 -0400 Date: Wed, 19 Jul 2017 19:26:28 +1000 (AEST) From: James Morris To: Kees Cook cc: Andrew Morton , Serge Hallyn , Andy Lutomirski , David Howells , "Eric W. Biederman" , John Johansen , Paul Moore , Stephen Smalley , Casey Schaufler , Tetsuo Handa , James Morris , Linus Torvalds , linux-fsdevel@vger.kernel.org, linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH v3 06/15] commoncap: Refactor to remove bprm_secureexec hook In-Reply-To: <1500416736-49829-7-git-send-email-keescook@chromium.org> Message-ID: References: <1500416736-49829-1-git-send-email-keescook@chromium.org> <1500416736-49829-7-git-send-email-keescook@chromium.org> User-Agent: Alpine 2.20 (LRH 67 2015-01-07) MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1473 Lines: 33 On Tue, 18 Jul 2017, Kees Cook wrote: > The commoncap implementation of the bprm_secureexec hook is the only LSM > that depends on the final call to its bprm_set_creds hook (since it may > be called for multiple files, it ignores bprm->called_set_creds). As a > result, it cannot safely _clear_ bprm->secureexec since other LSMs may > have set it. Instead, remove the bprm_secureexec hook by introducing a > new flag to bprm specific to commoncap: cap_elevated. This is similar to > cap_effective, but that is used for a specific subset of elevated > privileges, and exists solely to track state from bprm_set_creds to > bprm_secureexec. As such, it will be removed in the next patch. > > Here, set the new bprm->cap_elevated flag when setuid/setgid has happened > from bprm_fill_uid() or fscapabilities have been prepared. This temporarily > moves the bprm_secureexec hook to a static inline. The helper will be > removed in the next patch; this makes the step easier to review and bisect, > since this does not introduce any changes to inputs nor outputs to the > "elevated privileges" calculation. > > The new flag is merged with the bprm->secureexec flag in setup_new_exec() > since this marks the end of any further prepare_binprm() calls. > > Cc: Serge Hallyn > Cc: Andy Lutomirski > Signed-off-by: Kees Cook Acked-by: James Morris -- James Morris