Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Message-ID: <64c5b8b423774029c3030ae778bf214d36499d2a.camel@decadent.org.uk>
Subject: Re: [PATCH 4.9 45/47] Smack: Dont ignore other bprm->unsafe flags
 if LSM_UNSAFE_PTRACE is set
From:   Ben Hutchings <ben@decadent.org.uk>
To:     Jann Horn <jannh@google.com>,
        Casey Schaufler <casey@schaufler-ca.com>
Cc:     stable@vger.kernel.org,
        Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
        LKML <linux-kernel@vger.kernel.org>
Date:   Thu, 05 Dec 2019 15:50:07 +0000
In-Reply-To: <20191006172019.260683324@linuxfoundation.org>
References: <20191006172016.873463083@linuxfoundation.org>
         <20191006172019.260683324@linuxfoundation.org>
Content-Type: multipart/signed; micalg="pgp-sha512";
        protocol="application/pgp-signature"; boundary="=-WzXc7kbU+hI7YjTyITy7"
User-Agent: Evolution 3.30.5-1.1 
MIME-Version: 1.0
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk


--=-WzXc7kbU+hI7YjTyITy7
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Sun, 2019-10-06 at 19:21 +0200, Greg Kroah-Hartman wrote:
> From: Jann Horn <jannh@google.com>
>=20
> commit 3675f052b43ba51b99b85b073c7070e083f3e6fb upstream.
[...]
> --- a/security/smack/smack_lsm.c
> +++ b/security/smack/smack_lsm.c
> @@ -949,7 +949,8 @@ static int smack_bprm_set_creds(struct l
> =20
>  		if (rc !=3D 0)
>  			return rc;
> -	} else if (bprm->unsafe)
> +	}
> +	if (bprm->unsafe & ~LSM_UNSAFE_PTRACE)

I think this needs to be ~(LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)
for 4.9 and older branches.

Ben.

>  		return -EPERM;
> =20
>  	bsp->smk_task =3D isp->smk_task;
>=20
>=20
--=20
Ben Hutchings
Every program is either trivial or else contains at least one bug


--=-WzXc7kbU+hI7YjTyITy7
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: This is a digitally signed message part

-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEErCspvTSmr92z9o8157/I7JWGEQkFAl3pJy8ACgkQ57/I7JWG
EQmkkA//UD3fSIdKqnWIbSozwT+fUUEodPEtil8oS6YYfxQ30ozagDG/xri/pnc8
gvpAdqfdw1jMv31OSPJKimWj3vN7GGzrNuIM3Xx+GUiV3xkCu52yhW7WONUPJG9n
BHmp2Sq0iCYZfufHTY4p0lqdSw4BYKEQKH9+mPc+SD06tAXazjDVnxmfJYyb3RBY
XzUJYhHJ78pJuuUeQdZ+gZq+CS22i0H/vfX+EwbxiNHu3skGz42/TuQ9aJVnGJLa
kM/14+MLXAqJ82JRQ53LRn5aPJEkbnHAijx5f1tdPJ6wZ7QQejfCJux1uKL6ow2f
exfVmpr2sBz5c9vW3/hmzzQ7DACMnLikQyGHw3M5niR9WloDLroDaPwzI5D0KjrV
SobwoY0nv19vyOiSO7qnZ3QAk5lsCgGIfEP6gt67a/VXnzyLN4DEj+1jPgxyAs2M
h4HPPfZRcGk9D8AiNnn4gM/5vAibscWFb1QUBakP/e9396VRP2LUAAWa6wW7x1jH
iV93B0jve4/vHMYY7k2KqY+GU2mgt13hOT3kE9j/IzVUSZNWpup5+fcavnf8bnX7
vZw96C7TTxYPOFNaw06R5PxjQ3M1mA1pFDHWY7SfXewrD6V0HkIQ3q9uvWyr6Poi
k26kOColNp1s6r/NBr5+USxQawr8F4xAB2/Z75yyfU9CDbvOuLs=
=8ruJ
-----END PGP SIGNATURE-----

--=-WzXc7kbU+hI7YjTyITy7--