Messages in this thread | | | Date | Mon, 13 Jun 2022 16:46:29 -0700 | From | Kees Cook <> | Subject | Re: [PATCH 2/2] LSM: SafeSetID: Add setgroups() security policy handling |
| |
On Mon, Jun 13, 2022 at 02:00:03PM -0700, Micah Morton wrote: > On Mon, Jun 13, 2022 at 1:28 PM Micah Morton <mortonm@chromium.org> wrote: > [...] > > +static int safesetid_task_fix_setgroups(struct cred *new, const struct cred *old) > > +{ > > + int i; > > + > > + /* Do nothing if there are no setgid restrictions for our old RGID. */ > > + if (setid_policy_lookup((kid_t){.gid = old->gid}, INVALID_ID, GID) == SIDPOL_DEFAULT) > > + return 0; > > + > > + get_group_info(new->group_info); > > + for (i = 0; i < new->group_info->ngroups; i++) { > > + if (!id_permitted_for_cred(old, (kid_t){.gid = group_info->gid[i]}, GID)) { > > Oops, should be: > > !id_permitted_for_cred(old, (kid_t){.gid = new->group_info->gid[i]}, GID) > > Guess I won't send a whole new patch just for that one line
This begs the question: are there self-tests for this LSM somewhere? It'd be really nice to add them to tool/testing/selftests ...
-- Kees Cook
| |