From aeca4e2ca65c1aeacfbe520684e6421719d99417 Mon Sep 17 00:00:00 2001 From: Micah Morton Date: Wed, 16 Jan 2019 07:46:06 -0800 Subject: LSM: add SafeSetID module that gates setid calls SafeSetID gates the setid family of syscalls to restrict UID/GID transitions from a given UID/GID to only those approved by a system-wide whitelist. These restrictions also prohibit the given UIDs/GIDs from obtaining auxiliary privileges associated with CAP_SET{U/G}ID, such as allowing a user to set up user namespace UID mappings. For now, only gating the set*uid family of syscalls is supported, with support for set*gid coming in a future patch set. Signed-off-by: Micah Morton Acked-by: Kees Cook Signed-off-by: James Morris --- Documentation/admin-guide/LSM/index.rst | 1 + 1 file changed, 1 insertion(+) (limited to 'Documentation/admin-guide/LSM/index.rst') diff --git a/Documentation/admin-guide/LSM/index.rst b/Documentation/admin-guide/LSM/index.rst index 9842e21afd4a..a6ba95fbaa9f 100644 --- a/Documentation/admin-guide/LSM/index.rst +++ b/Documentation/admin-guide/LSM/index.rst @@ -46,3 +46,4 @@ subdirectories. Smack tomoyo Yama + SafeSetID -- cgit v1.2.3-59-g8ed1b