Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Subject: Re: [PATCH v5 0/3] binder: use cred instead of task for security
 context
To:     Todd Kjos <tkjos@google.com>, gregkh@linuxfoundation.org,
        arve@android.com, tkjos@android.com, maco@android.com,
        christian@brauner.io, jmorris@namei.org, serge@hallyn.com,
        paul@paul-moore.com, stephen.smalley.work@gmail.com,
        eparis@parisplace.org, keescook@chromium.org, jannh@google.com,
        jeffv@google.com, zohar@linux.ibm.com,
        linux-security-module@vger.kernel.org, selinux@vger.kernel.org,
        devel@driverdev.osuosl.org, linux-kernel@vger.kernel.org
Cc:     joel@joelfernandes.org, kernel-team@android.com,
        Casey Schaufler <casey@schaufler-ca.com>
References: <20211012165614.2873369-1-tkjos@google.com>
From:   Casey Schaufler <casey@schaufler-ca.com>
Message-ID: <3228ad97-b785-df8d-a0f3-a102468f4eff@schaufler-ca.com>
Date:   Tue, 12 Oct 2021 10:49:37 -0700
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:78.0) Gecko/20100101
 Thunderbird/78.14.0
MIME-Version: 1.0
In-Reply-To: <20211012165614.2873369-1-tkjos@google.com>
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
Content-Language: en-US
Content-Length: 1837
Precedence: bulk

On 10/12/2021 9:56 AM, Todd Kjos wrote:
> This series fixes the possible use of an incorrect security context
> when checking selinux permissions, getting a security ID, or lookup
> up the euid.
>
> The previous behavior was to save the group_leader 'struct task_struct'
> in binder_open() and using that to obtain security IDs or euids.
>
> This has been shown to be unreliable, so this series instead saves the
> 'struct cred' of the task that called binder_open(). This cred is used
> for these lookups instead of the task.
>
> v1 and v2 of this series were a single patch "binder: use euid from"
> cred instead of using task". During review, Stephen Smalley identified
> two more related issues so the corresponding patches were added to
> the series.
>
> v3:
> - add 2 patches to fix getsecid and euid
>
> v4:
> - fix minor checkpatch issues
> - fix build-break for !CONFIG_SECURITY
>
> v5:
> - reorder/refactor patches as suggested by Stephen Smalley so eiud fix
>   is first and saves the cred during binder_open()
> - set *secid=0 for !CONFIG_SECURITY version of secuirty_cred_getsecid()
>
> Todd Kjos (3):
>   binder: use euid from cred instead of using task
>   binder: use cred instead of task for selinux checks
>   binder: use cred instead of task for getsecid
>
>  drivers/android/binder.c          | 14 ++++++++------
>  drivers/android/binder_internal.h |  4 ++++
>  include/linux/lsm_hook_defs.h     | 14 +++++++-------
>  include/linux/lsm_hooks.h         | 14 +++++++-------
>  include/linux/security.h          | 28 ++++++++++++++--------------
>  security/security.c               | 14 +++++++-------
>  security/selinux/hooks.c          | 48 +++++++++++++-----------------------------------
>  7 files changed, 60 insertions(+), 76 deletions(-)

For the series:
	Acked-by: Casey Schaufler <casey@schaufler-ca.com>