Messages in this thread | | | From | Micah Morton <> | Date | Thu, 16 Jun 2022 10:19:41 -0700 | Subject | Re: [PATCH 2/2] LSM: SafeSetID: Add setgroups() security policy handling |
| |
On Tue, Jun 14, 2022 at 10:36 AM Micah Morton <mortonm@chromium.org> wrote: > > On Mon, Jun 13, 2022 at 4:46 PM Kees Cook <keescook@chromium.org> wrote: > > > > On Mon, Jun 13, 2022 at 02:00:03PM -0700, Micah Morton wrote: > > > On Mon, Jun 13, 2022 at 1:28 PM Micah Morton <mortonm@chromium.org> wrote: > > > [...] > > > > +static int safesetid_task_fix_setgroups(struct cred *new, const struct cred *old) > > > > +{ > > > > + int i; > > > > + > > > > + /* Do nothing if there are no setgid restrictions for our old RGID. */ > > > > + if (setid_policy_lookup((kid_t){.gid = old->gid}, INVALID_ID, GID) == SIDPOL_DEFAULT) > > > > + return 0; > > > > + > > > > + get_group_info(new->group_info); > > > > + for (i = 0; i < new->group_info->ngroups; i++) { > > > > + if (!id_permitted_for_cred(old, (kid_t){.gid = group_info->gid[i]}, GID)) { > > > > > > Oops, should be: > > > > > > !id_permitted_for_cred(old, (kid_t){.gid = new->group_info->gid[i]}, GID) > > > > > > Guess I won't send a whole new patch just for that one line > > > > This begs the question: are there self-tests for this LSM somewhere? > > It'd be really nice to add them to tool/testing/selftests ... > > There actually is tools/testing/selftests/safesetid/ but I haven't > updated it since v1 of SafeSetID that only accommodated UIDs. I've > been relying on integration testing we have out of tree on the Chrome > OS side but I suppose its reasonable to bring the selftest up to date > as well :) > > Also both patches are a couple lines off from the ones I was finished > developing/testing with.. some kind of screw up happened when I copied > from my dev machine to another where I could get git-send-email > working properly. I'll just resend these 2 patches along with the > update to the selftest.
Just sent the updated patches and selftest patch.
> > Thanks > > > > > -- > > Kees Cook
| |