linux-dev/security/safesetid, branch master

LSM: SafeSetID: Add setgroups() security policy handling

2022-07-15T18:24:42Z

The SafeSetID LSM has functionality for restricting setuid()/setgid() syscalls based on its configured security policies. This patch adds the analogous functionality for the setgroups() syscall. Security policy for the setgroups() syscall follows the same policies that are installed on the system for setgid() syscalls. Signed-off-by: Micah Morton

LSM: SafeSetID: Mark safesetid_initialized as __initdata

2021-06-10T16:52:32Z

Mark safesetid_initialized as __initdata since it is only used in initialization routine. Signed-off-by: Austin Kim Signed-off-by: Micah Morton

LSM: SafeSetID: Fix code specification by scripts/checkpatch.pl

2021-04-26T23:36:50Z

First, the code is found to be irregular through checkpatch.pl. Then I found break is really useless here. Signed-off-by: Yanwei Gao Signed-off-by: Micah Morton

LSM: SafeSetID: Fix warnings reported by test bot

2020-10-13T16:17:36Z

Fix multiple cast-to-union warnings related to casting kuid_t and kgid_t types to kid_t union type. Also fix incompatible type warning that arises from accidental omission of "__rcu" qualifier on the struct setid_ruleset pointer in the argument list for safesetid_file_read(). Reported-by: kernel test robot Signed-off-by: Thomas Cedeno Signed-off-by: Micah Morton

LSM: SafeSetID: Add GID security policy handling

2020-10-13T16:17:35Z

The SafeSetID LSM has functionality for restricting setuid() calls based on its configured security policies. This patch adds the analogous functionality for setgid() calls. This is mostly a copy-and-paste change with some code deduplication, plus slight modifications/name changes to the policy-rule-related structs (now contain GID rules in addition to the UID ones) and some type generalization since SafeSetID now needs to deal with kgid_t and kuid_t types. Signed-off-by: Thomas Cedeno Signed-off-by: Micah Morton

security/safesetid: Replace rcu_swap_protected() with rcu_replace_pointer()

2019-10-30T15:45:57Z

This commit replaces the use of rcu_swap_protected() with the more intuitively appealing rcu_replace_pointer() as a step towards removing rcu_swap_protected(). Link: https://lore.kernel.org/lkml/CAHk-=wiAsJLw1egFEE=Z7-GGtM6wcvtyytXZA1+BHqta4gg6Hw@mail.gmail.com/ Reported-by: Linus Torvalds Reported-by: Reported-by: kbuild test robot [ paulmck: From rcu_replace() to rcu_replace_pointer() per Ingo Molnar. ] Signed-off-by: Paul E. McKenney Cc: Micah Morton Cc: James Morris Cc: "Serge E. Hallyn" Cc:

LSM: SafeSetID: Stop releasing uninitialized ruleset

2019-09-17T18:27:05Z

The first time a rule set is configured for SafeSetID, we shouldn't be trying to release the previously configured ruleset, since there isn't one. Currently, the pointer that would point to a previously configured ruleset is uninitialized on first rule set configuration, leading to a crash when we try to call release_ruleset with that pointer. Acked-by: Jann Horn Signed-off-by: Micah Morton

LSM: SafeSetID: fix use of literal -1 in capable hook

2019-07-15T15:08:03Z

The capable() hook returns an error number. -EPERM is actually the same as -1, so this doesn't make a difference in behavior. Signed-off-by: Jann Horn Signed-off-by: Micah Morton

LSM: SafeSetID: verify transitive constrainedness

2019-07-15T15:07:51Z

Someone might write a ruleset like the following, expecting that it securely constrains UID 1 to UIDs 1, 2 and 3: 1:2 1:3 However, because no constraints are applied to UIDs 2 and 3, an attacker with UID 1 can simply first switch to UID 2, then switch to any UID from there. The secure way to write this ruleset would be: 1:2 1:3 2:2 3:3 , which uses "transition to self" as a way to inhibit the default-allow policy without allowing anything specific. This is somewhat unintuitive. To make sure that policy authors don't accidentally write insecure policies because of this, let the kernel verify that a new ruleset does not contain any entries that are constrained, but transitively unconstrained. Signed-off-by: Jann Horn Signed-off-by: Micah Morton

LSM: SafeSetID: add read handler

2019-07-15T15:07:40Z

For debugging a running system, it is very helpful to be able to see what policy the system is using. Add a read handler that can dump out a copy of the loaded policy. Signed-off-by: Jann Horn Signed-off-by: Micah Morton