Received: by 2002:a17:90a:bc8d:0:0:0:0 with SMTP id x13csp2405429pjr; Tue, 19 May 2020 14:31:32 -0700 (PDT) X-Google-Smtp-Source: ABdhPJz7PFlZ+4m7cAM/ToyLx/jRdMlhlt6BZVOx7Mg2ASIdIk+bjUyH/GJ73xDAs+BFuQW2GzTV X-Received: by 2002:a50:d98b:: with SMTP id w11mr684820edj.196.1589923892283; Tue, 19 May 2020 14:31:32 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1589923892; cv=none; d=google.com; s=arc-20160816; b=tjbObNpwCaqDMGW8CZb3Mp02AjE3NP/CbxlGdegpJh1Em9V9uuWLTUYkLCiwRKGKMf oXUK+RJT+PBvErD6dVg9IXYqlCBNvERYIf7g9Ze0BU7AWf6wXIYShWQV+Vt+mp8x1dLf v7SuAcCVIqFxNAfXKzgSV9LHOUeEfxLHYlt2/UWIiwCtN2Tm2kJakCLEiTf1ZisjEV8x rDwVUBH4p04oV/VTM3i1PvQOjGNBp+F9yu3jP7FrkO2H+gJHrXssH7fRQeUrkpGHfbJS VzLpHf1qHx42HCO3nPQnFxa5e2+HRGPaXoV+6XvjOA2Wf1CcPnHr4wP4hBh4jpQLbcP1 boSg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:mime-version:user-agent:references :message-id:in-reply-to:subject:cc:to:from:date; bh=wDi7peH4VeyAIGPqsBJNGvWdqPgrxiqX0g8xoOfF6m8=; b=rAj4HbiIr4Q009W4taQRtE3mPubsfsPrIhJyfkyVlyVC+TrCEIFa3LzY7H6jbd5svX PmnAR0rOsybwWOYXK7ZhGKF3wKXxNyYuObMb9aBYYklH9UWmFV/shzjcWdZFii5cM8NK 310A1KLA1gwPtUOtJqJ/83fNwE2PcgrPUXp57cCh32cNXj3GRBLa/rNuANIS74YATEF8 PdR3JaS+BSvte2VNWpZwWXlhew2p9BGwELyBIKKgouWNVpPh+aFmdb4L77dHOFF0yHs0 29FBto4um2HzK3jyCqCujDdaGxGYtaAXcuzZCqQ2sJ/XIR2ojND6fcO2nluJYqJ9znwU WjjA== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id qk2si631336ejb.685.2020.05.19.14.30.55; Tue, 19 May 2020 14:31:32 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726985AbgESV3C (ORCPT + 99 others); Tue, 19 May 2020 17:29:02 -0400 Received: from namei.org ([65.99.196.166]:38282 "EHLO namei.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1725998AbgESV3B (ORCPT ); Tue, 19 May 2020 17:29:01 -0400 Received: from localhost (localhost [127.0.0.1]) by namei.org (8.14.4/8.14.4) with ESMTP id 04JLSVQr028873; Tue, 19 May 2020 21:28:31 GMT Date: Wed, 20 May 2020 07:28:31 +1000 (AEST) From: James Morris To: Kees Cook cc: "Eric W. Biederman" , linux-kernel@vger.kernel.org, Linus Torvalds , Oleg Nesterov , Jann Horn , Greg Ungerer , Rob Landley , Bernd Edlinger , linux-fsdevel@vger.kernel.org, Al Viro , Alexey Dobriyan , Andrew Morton , Casey Schaufler , linux-security-module@vger.kernel.org, "Serge E. Hallyn" , Andy Lutomirski Subject: Re: [PATCH v2 2/8] exec: Factor security_bprm_creds_for_exec out of security_bprm_set_creds In-Reply-To: <202005191108.7A6E97831@keescook> Message-ID: References: <87h7wujhmz.fsf@x220.int.ebiederm.org> <87sgga6ze4.fsf@x220.int.ebiederm.org> <87v9l4zyla.fsf_-_@x220.int.ebiederm.org> <877dx822er.fsf_-_@x220.int.ebiederm.org> <87v9kszrzh.fsf_-_@x220.int.ebiederm.org> <202005191108.7A6E97831@keescook> User-Agent: Alpine 2.21 (LRH 202 2017-01-01) MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Tue, 19 May 2020, Kees Cook wrote: > > /* SELinux context only depends on initial program or script and not > > * the script interpreter */ > > - if (bprm->called_set_creds) > > - return 0; > > > > old_tsec = selinux_cred(current_cred()); > > new_tsec = selinux_cred(bprm->cred); > > As you've done in the other LSMs, I think this comment can be removed > (or moved to the top of the function) too. I'd prefer moved to top of the function. -- James Morris