lkml.org 
[lkml]   [2022]   [Jul]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
Subject[PATCH v13 23/26] ima: Show owning user namespace's uid and gid when displaying policy
Date
Show the uid and gid values relative to the user namespace that opened
the IMA policy file. The effect of this change is that when one displays
the policy from the user namespace that originally set the policy,
the same uid and gid values are shown in the policy as those that were
used when the policy was set.

Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Reviewed-by: Mimi Zohar <zohar@linux.ibm.com>
Reviewed-by: Serge Hallyn <serge@hallyn.com>

---
v13:
- Rephrased commit message following Serge's suggestion

v9:
- use seq_user_ns and from_k{g,u}id_munged()
---
security/integrity/ima/ima_policy.c | 19 +++++++++++++------
1 file changed, 13 insertions(+), 6 deletions(-)

diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c
index f5997f5a8f5b..181340678844 100644
--- a/security/integrity/ima/ima_policy.c
+++ b/security/integrity/ima/ima_policy.c
@@ -2080,6 +2080,7 @@ static void ima_policy_show_appraise_algos(struct seq_file *m,

int ima_policy_show(struct seq_file *m, void *v)
{
+ struct user_namespace *user_ns = seq_user_ns(m);
struct ima_rule_entry *entry = v;
int i;
char tbuf[64] = {0,};
@@ -2165,7 +2166,8 @@ int ima_policy_show(struct seq_file *m, void *v)
}

if (entry->flags & IMA_UID) {
- snprintf(tbuf, sizeof(tbuf), "%d", __kuid_val(entry->uid));
+ snprintf(tbuf, sizeof(tbuf),
+ "%d", from_kuid_munged(user_ns, entry->uid));
if (entry->uid_op == &uid_gt)
seq_printf(m, pt(Opt_uid_gt), tbuf);
else if (entry->uid_op == &uid_lt)
@@ -2176,7 +2178,8 @@ int ima_policy_show(struct seq_file *m, void *v)
}

if (entry->flags & IMA_EUID) {
- snprintf(tbuf, sizeof(tbuf), "%d", __kuid_val(entry->uid));
+ snprintf(tbuf, sizeof(tbuf),
+ "%d", from_kuid_munged(user_ns, entry->uid));
if (entry->uid_op == &uid_gt)
seq_printf(m, pt(Opt_euid_gt), tbuf);
else if (entry->uid_op == &uid_lt)
@@ -2187,7 +2190,8 @@ int ima_policy_show(struct seq_file *m, void *v)
}

if (entry->flags & IMA_GID) {
- snprintf(tbuf, sizeof(tbuf), "%d", __kgid_val(entry->gid));
+ snprintf(tbuf, sizeof(tbuf),
+ "%d", from_kgid_munged(user_ns, entry->gid));
if (entry->gid_op == &gid_gt)
seq_printf(m, pt(Opt_gid_gt), tbuf);
else if (entry->gid_op == &gid_lt)
@@ -2198,7 +2202,8 @@ int ima_policy_show(struct seq_file *m, void *v)
}

if (entry->flags & IMA_EGID) {
- snprintf(tbuf, sizeof(tbuf), "%d", __kgid_val(entry->gid));
+ snprintf(tbuf, sizeof(tbuf),
+ "%d", from_kgid_munged(user_ns, entry->gid));
if (entry->gid_op == &gid_gt)
seq_printf(m, pt(Opt_egid_gt), tbuf);
else if (entry->gid_op == &gid_lt)
@@ -2209,7 +2214,8 @@ int ima_policy_show(struct seq_file *m, void *v)
}

if (entry->flags & IMA_FOWNER) {
- snprintf(tbuf, sizeof(tbuf), "%d", __kuid_val(entry->fowner));
+ snprintf(tbuf, sizeof(tbuf),
+ "%d", from_kuid_munged(user_ns, entry->fowner));
if (entry->fowner_op == &uid_gt)
seq_printf(m, pt(Opt_fowner_gt), tbuf);
else if (entry->fowner_op == &uid_lt)
@@ -2220,7 +2226,8 @@ int ima_policy_show(struct seq_file *m, void *v)
}

if (entry->flags & IMA_FGROUP) {
- snprintf(tbuf, sizeof(tbuf), "%d", __kgid_val(entry->fgroup));
+ snprintf(tbuf, sizeof(tbuf),
+ "%d", from_kgid_munged(user_ns, entry->fgroup));
if (entry->fgroup_op == &gid_gt)
seq_printf(m, pt(Opt_fgroup_gt), tbuf);
else if (entry->fgroup_op == &gid_lt)
--
2.36.1
\
 
 \ /
  Last update: 2022-07-07 16:50    [W:0.167 / U:0.348 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site