Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
MIME-Version: 1.0
From:   Micah Morton <mortonm@chromium.org>
Date:   Mon, 1 Aug 2022 19:42:26 -0700
Message-ID: <CAJ-EccPH46FGKQj8gYEg5HGpmmRiqzrZouTZauwpvX-+2j4GNA@mail.gmail.com>
Subject: [GIT PULL] SafeSetID changes for v6.0
To:     Linus Torvalds <torvalds@linux-foundation.org>,
        Linux Kernel Mailing List <linux-kernel@vger.kernel.org>,
        linux-security-module <linux-security-module@vger.kernel.org>
Content-Type: text/plain; charset="UTF-8"
Precedence: bulk

The following changes since commit 32346491ddf24599decca06190ebca03ff9de7f8:


  Linux 5.19-rc6 (2022-07-10 14:40:51 -0700)


are available in the Git repository at:


  https://github.com/micah-morton/linux.git tags/safesetid-6.0


for you to fetch changes up to 64b634830c919979de4b18163e15d30df66e64a8:


  LSM: SafeSetID: add setgroups() testing to selftest (2022-07-15
18:24:42 +0000)


----------------------------------------------------------------

This pull request contains one commit that touches common kernel code,

one that adds functionality internal to the SafeSetID LSM code, and a

few other commits that only modify the SafeSetID LSM selftest.


The commit that touches common kernel code simply adds an LSM hook in

the setgroups() syscall that mirrors what is done for the existing LSM

hooks in the setuid() and setgid() syscalls. This commit combined with

the SafeSetID-specific one allow the LSM to filter setgroups() calls

according to configured rule sets in the same way that is already done

for setuid() and setgid().


The changes are based on v5.19-rc6 and have been in -next.


----------------------------------------------------------------

Micah Morton (6):

      LSM: SafeSetID: fix userns bug in selftest

      LSM: SafeSetID: selftest cleanup and prepare for GIDs

      LSM: SafeSetID: add GID testing to selftest

      security: Add LSM hook to setgroups() syscall

      LSM: SafeSetID: Add setgroups() security policy handling

      LSM: SafeSetID: add setgroups() testing to selftest


 include/linux/lsm_hook_defs.h                      |   1 +

 include/linux/lsm_hooks.h                          |   7 +

 include/linux/security.h                           |   7 +

 kernel/groups.c                                    |  13 +

 security/safesetid/lsm.c                           |  39 ++-

 security/security.c                                |   5 +

 tools/testing/selftests/safesetid/Makefile         |   2 +-

 tools/testing/selftests/safesetid/safesetid-test.c | 295 ++++++++++++++++++---

 8 files changed, 315 insertions(+), 54 deletions(-)