lkml.org 
[lkml]   [2020]   [Dec]   [28]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.10 508/717] Smack: Handle io_uring kernel thread privileges
    Date
    From: Casey Schaufler <casey@schaufler-ca.com>

    [ Upstream commit 942cb357ae7d9249088e3687ee6a00ed2745a0c7 ]

    Smack assumes that kernel threads are privileged for smackfs
    operations. This was necessary because the credential of the
    kernel thread was not related to a user operation. With io_uring
    the credential does reflect a user's rights and can be used.

    Suggested-by: Jens Axboe <axboe@kernel.dk>
    Acked-by: Jens Axboe <axboe@kernel.dk>
    Acked-by: Eric W. Biederman <ebiederm@xmission.com>
    Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    security/smack/smack_access.c | 5 +++--
    1 file changed, 3 insertions(+), 2 deletions(-)

    diff --git a/security/smack/smack_access.c b/security/smack/smack_access.c
    index efe2406a39609..7eabb448acab4 100644
    --- a/security/smack/smack_access.c
    +++ b/security/smack/smack_access.c
    @@ -688,9 +688,10 @@ bool smack_privileged_cred(int cap, const struct cred *cred)
    bool smack_privileged(int cap)
    {
    /*
    - * All kernel tasks are privileged
    + * Kernel threads may not have credentials we can use.
    + * The io_uring kernel threads do have reliable credentials.
    */
    - if (unlikely(current->flags & PF_KTHREAD))
    + if ((current->flags & (PF_KTHREAD | PF_IO_WORKER)) == PF_KTHREAD)
    return true;

    return smack_privileged_cred(cap, current_cred());
    --
    2.27.0


    \
     
     \ /
      Last update: 2020-12-28 15:25    [W:3.339 / U:0.032 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site