Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Date:   Thu, 12 Dec 2019 18:06:49 +0100
From:   Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To:     Ben Hutchings <ben@decadent.org.uk>
Cc:     Jann Horn <jannh@google.com>,
        Casey Schaufler <casey@schaufler-ca.com>,
        stable@vger.kernel.org, LKML <linux-kernel@vger.kernel.org>
Subject: Re: [PATCH 4.9 45/47] Smack: Dont ignore other bprm->unsafe flags if
 LSM_UNSAFE_PTRACE is set
Message-ID: <20191212170649.GA1681017@kroah.com>
References: <20191006172016.873463083@linuxfoundation.org>
 <20191006172019.260683324@linuxfoundation.org>
 <64c5b8b423774029c3030ae778bf214d36499d2a.camel@decadent.org.uk>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <64c5b8b423774029c3030ae778bf214d36499d2a.camel@decadent.org.uk>
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

On Thu, Dec 05, 2019 at 03:50:07PM +0000, Ben Hutchings wrote:
> On Sun, 2019-10-06 at 19:21 +0200, Greg Kroah-Hartman wrote:
> > From: Jann Horn <jannh@google.com>
> > 
> > commit 3675f052b43ba51b99b85b073c7070e083f3e6fb upstream.
> [...]
> > --- a/security/smack/smack_lsm.c
> > +++ b/security/smack/smack_lsm.c
> > @@ -949,7 +949,8 @@ static int smack_bprm_set_creds(struct l
> >  
> >  		if (rc != 0)
> >  			return rc;
> > -	} else if (bprm->unsafe)
> > +	}
> > +	if (bprm->unsafe & ~LSM_UNSAFE_PTRACE)
> 
> I think this needs to be ~(LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)
> for 4.9 and older branches.

Why?  Where did the LSM_UNSAFE_PTRACE_CAP requirement come from (or
really, go away?)

thanks,

greg k-h