From patchwork Fri Mar 15 11:37:22 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Christian_G=C3=B6ttsche?= X-Patchwork-Id: 13593345 X-Patchwork-Delegate: paul@paul-moore.com Received: from mail-ed1-f41.google.com (mail-ed1-f41.google.com [209.85.208.41]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4332A1B7E1; Fri, 15 Mar 2024 11:38:59 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.208.41 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1710502741; cv=none; b=pjOuI7u4gVZifmoaTNV0oK/mWk8iquHe/ySDvFcP14hOi2dbl3t2NPyVacW6sBnEyRIv1zXCCxoCip2+pWQyZuxt2yiSyfKSvyQz5yoURBX/lduNmfJ7pXPWq5MN7+9m58XNdy75Z62/L/RWfXlDQklIAi3Gh11P8/B6BnUYDSQ= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1710502741; c=relaxed/simple; bh=YhK/jnk1sN0Eu2k73vdEasVnkAA21VPShol4SbhmQDE=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version:Content-Type; b=AigQL+p0k9xR64d7kScCl9sY/XShtfoyniyE0HcHQNI4ap1dvUMmQG2lH6PL4MI3h3r4TP4tepeWkHdyLFKkgO0XSFGnhr5NGX1EGZ7AH63bpUrUD8J/TvHLqfQeX0Muye8zOC9/tccoaOzG4EPgPviJqUUWDUcXKdCry4ONHR8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=googlemail.com; spf=pass smtp.mailfrom=googlemail.com; dkim=pass (2048-bit key) header.d=googlemail.com header.i=@googlemail.com header.b=KUfLwR3Y; arc=none smtp.client-ip=209.85.208.41 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=googlemail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=googlemail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=googlemail.com header.i=@googlemail.com header.b="KUfLwR3Y" Received: by mail-ed1-f41.google.com with SMTP id 4fb4d7f45d1cf-568a3292916so1984175a12.1; Fri, 15 Mar 2024 04:38:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlemail.com; s=20230601; t=1710502738; x=1711107538; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=Ret+NQ/Tw5LK56vjyJDNxqW8M+4jtEPqZMI9umR9cCI=; b=KUfLwR3YydJAheGuADHmPCFzOmeuutYh+cPx3pAcCH1JXoYknT4HVT9fGpGQHhLJDi olBOT21+QWtaOksGCZZ8CHd6EMVD8QEJg4918AHNhf2I62E5flo7lL4zqJRsMDU7tSkI /KjLHhFQ3LP3wzTAq9iTpNJKHaTZeFHWPLaYFzQS6+mtrg4S3DEG2suKfDmG7En7mxhc Yll27I7dKJujo45T8mZwgFHw8iEAhJm92aNa3iQzb/IFiwXvwqqCsR/8Pw6SplacDztV N+9d6NozKyapLVifsnOheV49lTQZGZjObh9/llKi/FIhSOFBYJdC+nf5erbPQW8rhuao V40Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1710502738; x=1711107538; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=Ret+NQ/Tw5LK56vjyJDNxqW8M+4jtEPqZMI9umR9cCI=; b=er0RKIzF0IcU+kWC90ZhsiiCBSbhUkp2gA5VaqtcF2On1rKBtbSs1mQqtkmD0zvV1Y cqxNAKCjrWRra/Zo1WagShjBECx7tJsGMbm8s0e+iJkhu+AJug6VbHmLMF9iyirBqIjr ueeon/g/EYndS3y1pM5Efjjw0eAvybhA23DNVaaVrLDjSrT1PWVvxUZRL3pD0TA5vH5M PNSjCrjt69l2mMZBqcEOVpLgFlAkoTp6YSkYnWj49PGME05TccHUqiuI8obX0/LqDfcV 9z/ZcA/jd03Mmq637BbxTxK0p9koyNzLR705XgJ+QbgocOaoa9/PF0hUMev6jNXvpfUg y7EQ== X-Forwarded-Encrypted: i=1; AJvYcCWTWCZDE67T9IvmI0YS4CbbuhFeKCMu6uUu1Zg9qo+Z8onEHrZknnbxYsBA+Pbs5O3h2UVy5ZIAdhCyc+QqDYjPvsp77hQ4qYAIU6kb91XS6xVeH9MzljrD0ODBA8UsYfRULFOKuFhVXwyX1n4+qDo8H0DqxqozFaUC1A== X-Gm-Message-State: AOJu0Ywzp54EqvzcF+2uV6FJxeco5CfEWjSddoxAOHAJXAk1QRjZ7rAs ZQshyNSg7RA1BJS464uoBN4fZqaPA7dXXo75oGC8IzDJQUKBAWDAKKSqAO/B++3GPQ== X-Google-Smtp-Source: AGHT+IHxB7FB377TOoio0unYbfIwnkxt4g5n3Z4MDqCqa7L7No5w/MvY3FrF55UMKEirChoiUMRGJg== X-Received: by 2002:a05:6402:530a:b0:568:797a:f2d with SMTP id eo10-20020a056402530a00b00568797a0f2dmr2968341edb.27.1710502737191; Fri, 15 Mar 2024 04:38:57 -0700 (PDT) Received: from ddev.DebianHome (dynamic-095-119-217-226.95.119.pool.telefonica.de. [95.119.217.226]) by smtp.gmail.com with ESMTPSA id fg3-20020a056402548300b005682f47aea7sm1610024edb.94.2024.03.15.04.38.56 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 15 Mar 2024 04:38:56 -0700 (PDT) From: =?utf-8?q?Christian_G=C3=B6ttsche?= To: linux-security-module@vger.kernel.org Cc: linux-block@vger.kernel.org, Paul Moore , John Johansen , James Morris , "Serge E. Hallyn" , Stephen Smalley , Ondrej Mosnacek , Casey Schaufler , Christian Brauner , Roberto Sassu , Mimi Zohar , Khadija Kamran , Andrii Nakryiko , linux-kernel@vger.kernel.org, apparmor@lists.ubuntu.com, selinux@vger.kernel.org, bpf@vger.kernel.org Subject: [PATCH 01/10] capability: introduce new capable flag CAP_OPT_NOAUDIT_ONDENY Date: Fri, 15 Mar 2024 12:37:22 +0100 Message-ID: <20240315113828.258005-1-cgzones@googlemail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-security-module@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Introduce a new capable flag, CAP_OPT_NOAUDIT_ONDENY, to not generate an audit event if the requested capability is not granted. This will be used in a new capable_any() functionality to reduce the number of necessary capable calls. Handle the flag accordingly in AppArmor and SELinux. CC: linux-block@vger.kernel.org Suggested-by: Paul Moore Signed-off-by: Christian Göttsche Reviewed-by: Serge Hallyn Acked-by: Paul Moore Acked-by: John Johansen --- v5: rename flag to CAP_OPT_NOAUDIT_ONDENY, suggested by Serge: https://lore.kernel.org/all/20230606190013.GA640488@mail.hallyn.com/ --- include/linux/security.h | 2 ++ security/apparmor/capability.c | 8 +++++--- security/selinux/hooks.c | 14 ++++++++------ 3 files changed, 15 insertions(+), 9 deletions(-) diff --git a/include/linux/security.h b/include/linux/security.h index 41a8f667bdfa..c60cae78ff8b 100644 --- a/include/linux/security.h +++ b/include/linux/security.h @@ -70,6 +70,8 @@ struct lsm_ctx; #define CAP_OPT_NOAUDIT BIT(1) /* If capable is being called by a setid function */ #define CAP_OPT_INSETID BIT(2) +/* If capable should audit the security request for authorized requests only */ +#define CAP_OPT_NOAUDIT_ONDENY BIT(3) /* LSM Agnostic defines for security_sb_set_mnt_opts() flags */ #define SECURITY_LSM_NATIVE_LABELS 1 diff --git a/security/apparmor/capability.c b/security/apparmor/capability.c index 9934df16c843..08c9c9a0fc19 100644 --- a/security/apparmor/capability.c +++ b/security/apparmor/capability.c @@ -108,7 +108,8 @@ static int audit_caps(struct apparmor_audit_data *ad, struct aa_profile *profile * profile_capable - test if profile allows use of capability @cap * @profile: profile being enforced (NOT NULL, NOT unconfined) * @cap: capability to test if allowed - * @opts: CAP_OPT_NOAUDIT bit determines whether audit record is generated + * @opts: CAP_OPT_NOAUDIT/CAP_OPT_NOAUDIT_ONDENY bit determines whether audit + * record is generated * @ad: audit data (MAY BE NULL indicating no auditing) * * Returns: 0 if allowed else -EPERM @@ -126,7 +127,7 @@ static int profile_capable(struct aa_profile *profile, int cap, else error = -EPERM; - if (opts & CAP_OPT_NOAUDIT) { + if ((opts & CAP_OPT_NOAUDIT) || ((opts & CAP_OPT_NOAUDIT_ONDENY) && error)) { if (!COMPLAIN_MODE(profile)) return error; /* audit the cap request in complain mode but note that it @@ -143,7 +144,8 @@ static int profile_capable(struct aa_profile *profile, int cap, * @subj_cred: cred we are testing capability against * @label: label being tested for capability (NOT NULL) * @cap: capability to be tested - * @opts: CAP_OPT_NOAUDIT bit determines whether audit record is generated + * @opts: CAP_OPT_NOAUDIT/CAP_OPT_NOAUDIT_ONDENY bit determines whether audit + * record is generated * * Look up capability in profile capability set. * diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index 3448454c82d0..1a2c7c1a89be 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -1624,7 +1624,7 @@ static int cred_has_capability(const struct cred *cred, u16 sclass; u32 sid = cred_sid(cred); u32 av = CAP_TO_MASK(cap); - int rc; + int rc, rc2; ad.type = LSM_AUDIT_DATA_CAP; ad.u.cap = cap; @@ -1643,11 +1643,13 @@ static int cred_has_capability(const struct cred *cred, } rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd); - if (!(opts & CAP_OPT_NOAUDIT)) { - int rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad); - if (rc2) - return rc2; - } + if ((opts & CAP_OPT_NOAUDIT) || ((opts & CAP_OPT_NOAUDIT_ONDENY) && rc)) + return rc; + + rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad); + if (rc2) + return rc2; + return rc; } From patchwork Fri Mar 15 11:37:23 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Christian_G=C3=B6ttsche?= X-Patchwork-Id: 13593346 X-Patchwork-Delegate: paul@paul-moore.com Received: from mail-ed1-f43.google.com (mail-ed1-f43.google.com [209.85.208.43]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E399C1B800; Fri, 15 Mar 2024 11:38:59 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.208.43 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1710502741; cv=none; b=PCTrMLOPOnNrV37EUk7HzoEUCZukvZnvO3ipV65GlwO3/Exk+zg2A1e+W8M6nzICdc+hzS8Zn/j07eHwYNod0egX1zlONWqYzOO1usHvR8VsmRNP4NDrTi14WpzdpzOpRPDoyF5wgKwT0nVd/gwp/DNOJB+piI33mPN+ViJf8UM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1710502741; c=relaxed/simple; bh=j7P+rtIooN2RFNFnyJNgWaUvzjlWg7b4FVbZggyZikc=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=mfTAxlOlvWiN47myPZaOCq0Uw2NBup1mJ/mkU57zkenU2uJ36ddLrIBk+BT1KXWsIyXdcoF8kAAIjX4vEI9hyhMHXLI5gUinvPvRRQ/9lkgrd2aa1M0dwwk4ukqDK6K7QZUZtgPv/B09PEaNekTDGVfuZeat/erOSwo11NNIn20= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=googlemail.com; spf=pass smtp.mailfrom=googlemail.com; dkim=pass (2048-bit key) header.d=googlemail.com header.i=@googlemail.com header.b=hpTRPgYe; arc=none smtp.client-ip=209.85.208.43 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=googlemail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=googlemail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=googlemail.com header.i=@googlemail.com header.b="hpTRPgYe" Received: by mail-ed1-f43.google.com with SMTP id 4fb4d7f45d1cf-568a4e4893aso2179820a12.1; Fri, 15 Mar 2024 04:38:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlemail.com; s=20230601; t=1710502738; x=1711107538; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=mi8E9ZQLQ9LPypjXpm7Mdpqzk72OEqhwCGPKB2XFHjg=; b=hpTRPgYe5GXaEAn9eTTcpIsZrEFO8P5joIE/JhnbQe5VpSqWGHGY6pgFkQPoeSjNxb fTyQTzI844hwWZ3jQCGtUywow2NOllXYqunr1vxQUaoVZDtUfDxCGUgZOwk4w1IdpXLc FVrlb1B2GUaIaBOexBq5OePELYSy5skHSAEfl+j+h8yX4r9wmaNr8Sz2cDuHoU6bsXAF F6jBSKCFbULXMyCiYXv/OLgka1XlfYe73+dJ2CZsL84DFaYwNVKhDoq2QmFj05kHeJmQ Rpi8UXIpXLYqA4sEdOy0d8KVBxC6gybj5hnotkE2YbyGJLFP8jsyOhopJnSh+yOip27Q jFrw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1710502738; x=1711107538; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=mi8E9ZQLQ9LPypjXpm7Mdpqzk72OEqhwCGPKB2XFHjg=; b=Z3eDgcvJcknfHzPkpcAGVrs2HG921dc9yxhb4nc5zy1qsJfhQu6zJqu1dZX/8xfvJA pV1t7fRFUhwEm/Wd5dwmkdkm52vzpJal0eboZ3zekl2ZrHM9QSYC6QOWGdlM6UL+FB9r 5i7hDdWn8KDOILyOgN3fuypFWAsz3wXTjaGDVhEn8DtZu9idbL9Vg6g+s0M/UlLIJQgu 7COvCgp6EC8s5Er+BOUYJnh83D3i5oQ3MLiMtpDj12/v/P48y6L995ppH9U3fGwmqldK G7qcaJNMN9yiek1OQrvM1WZDeWCjDCiyVi0T7FtkjaaeKukw4CS3houuqcSNlOCc7RYz LNeQ== X-Forwarded-Encrypted: i=1; AJvYcCUT576hySEWT275IgjZjkdJhutpz18TI7V1eXIakSQ665FCCzcucaOhxeZM+QIq/whnnfkKmdye8X2FWOMsvHtLATanH9QmN3gflZ7ELifMyZuEuAHoblwXsi11XsxH1ue7 X-Gm-Message-State: AOJu0YzXAx1/fa5lQxbBjI6KEo4vh/YpcCqXZHbNL6P1fYYneKDlxwuR bT6svy4rF+i5YZj9TcZ39B1Vm+aachoCwN5Oe/UZXZu4maUsuorQhhBYlir7effIKQ== X-Google-Smtp-Source: AGHT+IHXsjVgfepYPNctqMBAmfS5W/9E8hiHUchOPAmdfdCjerS73D/Om6GB/wuGRmgu/APbTnlg/g== X-Received: by 2002:a50:8d14:0:b0:568:b0f4:fe69 with SMTP id s20-20020a508d14000000b00568b0f4fe69mr1272361eds.12.1710502738062; Fri, 15 Mar 2024 04:38:58 -0700 (PDT) Received: from ddev.DebianHome (dynamic-095-119-217-226.95.119.pool.telefonica.de. [95.119.217.226]) by smtp.gmail.com with ESMTPSA id fg3-20020a056402548300b005682f47aea7sm1610024edb.94.2024.03.15.04.38.57 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 15 Mar 2024 04:38:57 -0700 (PDT) From: =?utf-8?q?Christian_G=C3=B6ttsche?= To: linux-security-module@vger.kernel.org Cc: linux-block@vger.kernel.org, Serge Hallyn , linux-kernel@vger.kernel.org, bpf@vger.kernel.org Subject: [PATCH 02/10] capability: add any wrappers to test for multiple caps with exactly one audit message Date: Fri, 15 Mar 2024 12:37:23 +0100 Message-ID: <20240315113828.258005-2-cgzones@googlemail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20240315113828.258005-1-cgzones@googlemail.com> References: <20240315113828.258005-1-cgzones@googlemail.com> Precedence: bulk X-Mailing-List: linux-security-module@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Add the interfaces `capable_any()` and `ns_capable_any()` as an alternative to multiple `capable()`/`ns_capable()` calls, like `capable_any(CAP_SYS_NICE, CAP_SYS_ADMIN)` instead of `capable(CAP_SYS_NICE) || capable(CAP_SYS_ADMIN)`. `capable_any()`/`ns_capable_any()` will in particular generate exactly one audit message, either for the left most capability in effect or, if the task has none, the first one. This is especially helpful with regard to SELinux, where each audit message about a not allowed capability request will create a denial message. Using this new wrapper with the least invasive capability as left most argument (e.g. CAP_SYS_NICE before CAP_SYS_ADMIN) enables policy writers to only grant the least invasive one for the particular subject instead of both. CC: linux-block@vger.kernel.org Signed-off-by: Christian Göttsche Reviewed-by: Serge Hallyn --- v5: - add check for identical passed capabilities - rename internal helper according to flag rename to ns_capable_noauditondeny() v4: Use CAP_OPT_NODENYAUDIT via added ns_capable_nodenyaudit() v3: - rename to capable_any() - fix typo in function documentation - add ns_capable_any() v2: avoid varargs and fix to two capabilities; capable_or3() can be added later if needed --- include/linux/capability.h | 10 ++++++ kernel/capability.c | 73 ++++++++++++++++++++++++++++++++++++++ 2 files changed, 83 insertions(+) diff --git a/include/linux/capability.h b/include/linux/capability.h index 0c356a517991..eeb958440656 100644 --- a/include/linux/capability.h +++ b/include/linux/capability.h @@ -146,7 +146,9 @@ extern bool has_capability_noaudit(struct task_struct *t, int cap); extern bool has_ns_capability_noaudit(struct task_struct *t, struct user_namespace *ns, int cap); extern bool capable(int cap); +extern bool capable_any(int cap1, int cap2); extern bool ns_capable(struct user_namespace *ns, int cap); +extern bool ns_capable_any(struct user_namespace *ns, int cap1, int cap2); extern bool ns_capable_noaudit(struct user_namespace *ns, int cap); extern bool ns_capable_setid(struct user_namespace *ns, int cap); #else @@ -172,10 +174,18 @@ static inline bool capable(int cap) { return true; } +static inline bool capable_any(int cap1, int cap2) +{ + return true; +} static inline bool ns_capable(struct user_namespace *ns, int cap) { return true; } +static inline bool ns_capable_any(struct user_namespace *ns, int cap1, int cap2) +{ + return true; +} static inline bool ns_capable_noaudit(struct user_namespace *ns, int cap) { return true; diff --git a/kernel/capability.c b/kernel/capability.c index dac4df77e376..73358abfe2e1 100644 --- a/kernel/capability.c +++ b/kernel/capability.c @@ -402,6 +402,23 @@ bool ns_capable_noaudit(struct user_namespace *ns, int cap) } EXPORT_SYMBOL(ns_capable_noaudit); +/** + * ns_capable_noauditondeny - Determine if the current task has a superior capability + * (unaudited when unauthorized) in effect + * @ns: The usernamespace we want the capability in + * @cap: The capability to be tested for + * + * Return true if the current task has the given superior capability currently + * available for use, false if not. + * + * This sets PF_SUPERPRIV on the task if the capability is available on the + * assumption that it's about to be used. + */ +static bool ns_capable_noauditondeny(struct user_namespace *ns, int cap) +{ + return ns_capable_common(ns, cap, CAP_OPT_NOAUDIT_ONDENY); +} + /** * ns_capable_setid - Determine if the current task has a superior capability * in effect, while signalling that this check is being done from within a @@ -421,6 +438,62 @@ bool ns_capable_setid(struct user_namespace *ns, int cap) } EXPORT_SYMBOL(ns_capable_setid); +/** + * ns_capable_any - Determine if the current task has one of two superior capabilities in effect + * @ns: The usernamespace we want the capability in + * @cap1: The capabilities to be tested for first + * @cap2: The capabilities to be tested for secondly + * + * Return true if the current task has at least one of the two given superior + * capabilities currently available for use, false if not. + * + * In contrast to or'ing capable() this call will create exactly one audit + * message, either for @cap1, if it is granted or both are not permitted, + * or @cap2, if it is granted while the other one is not. + * + * The capabilities should be ordered from least to most invasive, i.e. CAP_SYS_ADMIN last. + * + * This sets PF_SUPERPRIV on the task if the capability is available on the + * assumption that it's about to be used. + */ +bool ns_capable_any(struct user_namespace *ns, int cap1, int cap2) +{ + if (cap1 == cap2) + return ns_capable(ns, cap1); + + if (ns_capable_noauditondeny(ns, cap1)) + return true; + + if (ns_capable_noauditondeny(ns, cap2)) + return true; + + return ns_capable(ns, cap1); +} +EXPORT_SYMBOL(ns_capable_any); + +/** + * capable_any - Determine if the current task has one of two superior capabilities in effect + * @cap1: The capabilities to be tested for first + * @cap2: The capabilities to be tested for secondly + * + * Return true if the current task has at least one of the two given superior + * capabilities currently available for use, false if not. + * + * In contrast to or'ing capable() this call will create exactly one audit + * message, either for @cap1, if it is granted or both are not permitted, + * or @cap2, if it is granted while the other one is not. + * + * The capabilities should be ordered from least to most invasive, i.e. CAP_SYS_ADMIN last. + * + * This sets PF_SUPERPRIV on the task if the capability is available on the + * assumption that it's about to be used. + */ +bool capable_any(int cap1, int cap2) +{ + return ns_capable_any(&init_user_ns, cap1, cap2); +} +EXPORT_SYMBOL(capable_any); + /** * capable - Determine if the current task has a superior capability in effect * @cap: The capability to be tested for From patchwork Fri Mar 15 11:37:24 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Christian_G=C3=B6ttsche?= X-Patchwork-Id: 13593347 X-Patchwork-Delegate: paul@paul-moore.com Received: from mail-ej1-f44.google.com (mail-ej1-f44.google.com [209.85.218.44]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7F5471B809; Fri, 15 Mar 2024 11:39:00 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.218.44 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1710502742; cv=none; b=Zc9FWNM9JG/l5TlokHr+GCk8dWQc3+4RKIrlUUPnQRhoEwFH2NkP6rcrR7s0qLYL8mcqE9CpanW9EmfEO+bt6pbHtrA01t9Vz2RbdA5MJijpaCl1MElcM30WHnoWhEtOZ1WTXOA4yNa+gA7dl1Rk2IhrgN96W10MKaYdVqC6Ulk= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1710502742; c=relaxed/simple; bh=orpFgHvtrDbE/5GCfbNJ/7zDDiGgsLl9lSdt61UsgGA=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=BdHfMitR0LNHwxAjQhufM9KTdugpgueZMBNkM4yokRnFMyPfgSZQgV63jpWVW/ZrdR/9CSKaywYQlMWsBdbpeED9TRM1QoBxCKL57mCs/DM0oAj6XaSsrB04h14Bd+LUOX7adLXnWvnYvBNkoGYd/lBmq/lZHhEHyiAiDhccGhw= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=googlemail.com; spf=pass smtp.mailfrom=googlemail.com; dkim=pass (2048-bit key) header.d=googlemail.com header.i=@googlemail.com header.b=I9tCSUPS; arc=none smtp.client-ip=209.85.218.44 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=googlemail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=googlemail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=googlemail.com header.i=@googlemail.com header.b="I9tCSUPS" Received: by mail-ej1-f44.google.com with SMTP id a640c23a62f3a-a449c5411e1so260277266b.1; Fri, 15 Mar 2024 04:39:00 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlemail.com; s=20230601; t=1710502739; x=1711107539; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=O1vRUl7sstn1m+3KlSoNBU6wq9u3nGCzm/f05r+8MPQ=; b=I9tCSUPSLrU3mzcXMuvKCPvVjauFgTujP/14p+2/cRE7vz9xI7guiPQ6z3w4kCMsLC jc28esjZEs4SwZeplSokvBsMjw1dfHKd4wRtndVDGEaDnHAryezLKaozlJQz49OpN024 LvGqyeByyy3ELRqrTMbfpzhCCaiKyZdmh0huPbvjd7y0cXqxcKsY8+jYVRCc3BHYuv3Y /8svInMbSGimZgnsFHxwg6sHB5/GH0YwndiTCBIalOYLrzKxKK9PGB6+XqtPFqXCarAf aLshiUSYIGPClfX7NY/Oqrccc12FpSlsYEKzYDvI1c8ohtK1HNQJ3ZtnhnwcKmjIK73w vapw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1710502739; x=1711107539; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=O1vRUl7sstn1m+3KlSoNBU6wq9u3nGCzm/f05r+8MPQ=; b=j4pjfXV+EUzeJpM8j1W13nMvRTm7lYMmwO4EyxU6/pkZW1FTLdt6GOY+5krTCZ6u+T 2cV2a9d/Sp1RxW1ZfueLyLFjJ1Q6omWDo7HF/b0yYyZH88cC7LWVRkjVSLa5KGThsw9c otis+9JAy+6FQryThbZ8fo9KlEgoblhyXVnJW6TkTrsZpdnu9IXyHpttKhvQD8JeG9V8 Rc4SkGJMNiegNQrYUIiKhb5LU1xHVHGXxUVMwFXPutdSjbxxJEwxpzlApjE99fYP58dK 2SU+NF0v2QJswW2y/Wy53XAuw/DGyuGmse303uHoOXpDUhPZC6pknE7zXu4X5v9/3Oa0 L+cw== X-Forwarded-Encrypted: i=1; AJvYcCV4NQK8iC54Und3P8CHCYsXlbe3MDfbAffh8uCQnn4/OW7OC4wISDXpCcX0XEkg2aiN8bT88InijviJvSXyvfWcR+l4ZuqsU7dOGBF9O8GUDur3SEFpFIS3zJ6ybvKdQnof X-Gm-Message-State: AOJu0YzFpzn0ptcUGO/RFfUxFC1Fpyj81r6muaVa+4tbmAcXzaoosmPu XxzxmjcKUB3T/NR5E5vitzDJ8lL10RHltUohBQqUnxYdNdfocT4GvVH/90p7zZH6vw== X-Google-Smtp-Source: AGHT+IHnTSUzMhQj8J4CoLtxGIEjCQa5J7Xvsgz1J7EvqPwTz4uTZ1RAxz7js99wxdjPzIEbgYwVKA== X-Received: by 2002:a17:906:b80b:b0:a46:7ccc:44a with SMTP id dv11-20020a170906b80b00b00a467ccc044amr1914855ejb.14.1710502738897; Fri, 15 Mar 2024 04:38:58 -0700 (PDT) Received: from ddev.DebianHome (dynamic-095-119-217-226.95.119.pool.telefonica.de. [95.119.217.226]) by smtp.gmail.com with ESMTPSA id fg3-20020a056402548300b005682f47aea7sm1610024edb.94.2024.03.15.04.38.58 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 15 Mar 2024 04:38:58 -0700 (PDT) From: =?utf-8?q?Christian_G=C3=B6ttsche?= To: linux-security-module@vger.kernel.org Cc: Serge Hallyn , linux-kernel@vger.kernel.org, bpf@vger.kernel.org Subject: [PATCH 03/10] capability: use new capable_any functionality Date: Fri, 15 Mar 2024 12:37:24 +0100 Message-ID: <20240315113828.258005-3-cgzones@googlemail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20240315113828.258005-1-cgzones@googlemail.com> References: <20240315113828.258005-1-cgzones@googlemail.com> Precedence: bulk X-Mailing-List: linux-security-module@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Use the new added capable_any function in appropriate cases, where a task is required to have any of two capabilities. Signed-off-by: Christian Göttsche Acked-by: Andrii Nakryiko --- v3: - rename to capable_any() - simplify checkpoint_restore_ns_capable() --- include/linux/capability.h | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/include/linux/capability.h b/include/linux/capability.h index eeb958440656..4db0ffb47271 100644 --- a/include/linux/capability.h +++ b/include/linux/capability.h @@ -204,18 +204,17 @@ extern bool file_ns_capable(const struct file *file, struct user_namespace *ns, extern bool ptracer_capable(struct task_struct *tsk, struct user_namespace *ns); static inline bool perfmon_capable(void) { - return capable(CAP_PERFMON) || capable(CAP_SYS_ADMIN); + return capable_any(CAP_PERFMON, CAP_SYS_ADMIN); } static inline bool bpf_capable(void) { - return capable(CAP_BPF) || capable(CAP_SYS_ADMIN); + return capable_any(CAP_BPF, CAP_SYS_ADMIN); } static inline bool checkpoint_restore_ns_capable(struct user_namespace *ns) { - return ns_capable(ns, CAP_CHECKPOINT_RESTORE) || - ns_capable(ns, CAP_SYS_ADMIN); + return ns_capable_any(ns, CAP_CHECKPOINT_RESTORE, CAP_SYS_ADMIN); } /* audit system wants to get cap info from files as well */ From patchwork Fri Mar 15 11:37:25 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Christian_G=C3=B6ttsche?= X-Patchwork-Id: 13593348 X-Patchwork-Delegate: paul@paul-moore.com Received: from mail-ed1-f53.google.com (mail-ed1-f53.google.com [209.85.208.53]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 623891B81F; Fri, 15 Mar 2024 11:39:01 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.208.53 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1710502743; cv=none; b=ldR4B3ISFYmLSGu1nafjSSo97SW4fLW7u43VRSm7xl7Zz6hVMtwIlzIGdTR16oSudRus/HjgFOGNw1qeCXIKgWmHQuO3FFn+o1mXARoqGQPr0cUyHWhHSUMiH4lOvpstUQ32SH7EyAZ6BNEPXDuXm/MbZBJbBwodRc399UBgM9I= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1710502743; c=relaxed/simple; bh=HmGGEmUedu3998fS4GIHrSJ4xICz6CRhS6+OSHoY6Js=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=IoyEfMEZcVXAUi620WygZsP+0JaooSUBYMBXpPXfd+/RBdK9q8wwEbpIsPHNSnSDyv5sZSeZfLHTutvwbUUtvxzaGr1nxCNO5THAccWQV+Z44ENzc6S9fGxrOG+LCDgFapI1YwbB7PxUuZjZAQhy4+axLdymzOaI7m3ETSyyCXQ= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=googlemail.com; spf=pass smtp.mailfrom=googlemail.com; dkim=pass (2048-bit key) header.d=googlemail.com header.i=@googlemail.com header.b=ZA8tl7Pw; arc=none smtp.client-ip=209.85.208.53 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=googlemail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=googlemail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=googlemail.com header.i=@googlemail.com header.b="ZA8tl7Pw" Received: by mail-ed1-f53.google.com with SMTP id 4fb4d7f45d1cf-56829f41f81so2669626a12.2; Fri, 15 Mar 2024 04:39:01 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlemail.com; s=20230601; t=1710502740; x=1711107540; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=JbGx8NSxuyFGtW+6h8d45ucKpQT9LiM32oyhrb8awck=; b=ZA8tl7PwfGUz8WjOiAFleW3DARsqcXFaFfcDOQMw3TYtTzik0vZPdNsOKWBJku1RoK mY4YiBXV90aMio9Cws3Yn/isaBC2WNZhKyBUNHVA7V4sMbmugdXomAad7VLNKEw53jKT TXx+YEC8qq3GByVugA5p+nhL8flbBBWUCuth0Ps5diS5sWnFP1u78w04FaCML56IMoOu oFRlWKqH3LHwxBH71LmVywGMK+00KC0ZdGr1F+qaO/FVsCIZOFMWqdqoWncY5xsutC/C jLHSgZu5DMlRgmZ8stSBXTwTfTvAO7nDZnyxGwRmK1IrmEfyYNRhfKhbUQ67NQUM2kxo qDGA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1710502740; x=1711107540; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=JbGx8NSxuyFGtW+6h8d45ucKpQT9LiM32oyhrb8awck=; b=Pt4RcYkxNYEB5x5abCcx72HZMyX18dfWastShNURd1p/3OMYAVQpnOfOMpfj50mms+ R/+A9fvxkZ+1lC16wPTksN3HfjxMVgiYhRb0iXLoPAIo7BYrPpoaCZLws168yFTWsp50 3b66PGjofOAFLFyXigK7Qw+CCJFJn0cX/lecHl6/g85KvdWDPeaTeMkaO1t2QXm6YzQr KcBnGsm03JmTLXs0mgysrbuj0JUmTtnjQNajRKkE+XHvsJn8lPFO2K10cF66b+WthRjY 6UH4hPaIyN43Nf5D/VqqvPR3v3l/MuweWoiCSYxvJ7pgE/fdgx97J813JRvhXNPWAMgX adig== X-Forwarded-Encrypted: i=1; AJvYcCWyEkQKJvz8D4BNTKEx4EhcIMBH88bhVPDAmqcQKdMQdDsyUm6GJig5XeoTFEU7SsHPBb8APrgfD0FirxNtAK7EPZJiwb8IEGTZRsCGH76HkE3OAdXlCALfJski3i+zH9fSsWDDPSpoatf4def8ZqYpG8PBQsJstFafy1TlP/Q= X-Gm-Message-State: AOJu0YyiwMDMK4VtuV4NwjXz+m9x326o11hP21cOaBgCJF0v0eFSK+sR xEQBuzFWEqkhGMJXNQv6LZUBNzBunXk94zQ3JXHADMwglTAQOZ5Hy9YIyNxOjkeNpg== X-Google-Smtp-Source: AGHT+IFY5K+9DDgx4ObwJ0dCYxDgSvtfoZadfKP7DyB/rvVKCmS0q5ZNQdZ4UE7liIIVw2Wnv2Owpw== X-Received: by 2002:a05:6402:b34:b0:568:32cc:f808 with SMTP id bo20-20020a0564020b3400b0056832ccf808mr2135290edb.15.1710502739644; Fri, 15 Mar 2024 04:38:59 -0700 (PDT) Received: from ddev.DebianHome (dynamic-095-119-217-226.95.119.pool.telefonica.de. [95.119.217.226]) by smtp.gmail.com with ESMTPSA id fg3-20020a056402548300b005682f47aea7sm1610024edb.94.2024.03.15.04.38.59 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 15 Mar 2024 04:38:59 -0700 (PDT) From: =?utf-8?q?Christian_G=C3=B6ttsche?= To: linux-security-module@vger.kernel.org Cc: Jens Axboe , Bart Van Assche , Serge Hallyn , Alistair Delva , linux-block@vger.kernel.org, linux-kernel@vger.kernel.org, bpf@vger.kernel.org Subject: [PATCH 04/10] block: use new capable_any functionality Date: Fri, 15 Mar 2024 12:37:25 +0100 Message-ID: <20240315113828.258005-4-cgzones@googlemail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20240315113828.258005-1-cgzones@googlemail.com> References: <20240315113828.258005-1-cgzones@googlemail.com> Precedence: bulk X-Mailing-List: linux-security-module@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Use the new added capable_any function in appropriate cases, where a task is required to have any of two capabilities. Reorder CAP_SYS_ADMIN last. Fixes: 94c4b4fd25e6 ("block: Check ADMIN before NICE for IOPRIO_CLASS_RT") Signed-off-by: Christian Göttsche --- v3: rename to capable_any() --- block/ioprio.c | 9 +-------- 1 file changed, 1 insertion(+), 8 deletions(-) diff --git a/block/ioprio.c b/block/ioprio.c index 73301a261429..6e1291679ea0 100644 --- a/block/ioprio.c +++ b/block/ioprio.c @@ -37,14 +37,7 @@ int ioprio_check_cap(int ioprio) switch (class) { case IOPRIO_CLASS_RT: - /* - * Originally this only checked for CAP_SYS_ADMIN, - * which was implicitly allowed for pid 0 by security - * modules such as SELinux. Make sure we check - * CAP_SYS_ADMIN first to avoid a denial/avc for - * possibly missing CAP_SYS_NICE permission. - */ - if (!capable(CAP_SYS_ADMIN) && !capable(CAP_SYS_NICE)) + if (!capable_any(CAP_SYS_NICE, CAP_SYS_ADMIN)) return -EPERM; fallthrough; /* rt has prio field too */ From patchwork Fri Mar 15 11:37:26 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Christian_G=C3=B6ttsche?= X-Patchwork-Id: 13593349 X-Patchwork-Delegate: paul@paul-moore.com Received: from mail-ej1-f53.google.com (mail-ej1-f53.google.com [209.85.218.53]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B59811C692; Fri, 15 Mar 2024 11:39:03 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.218.53 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1710502745; cv=none; b=lhIN4Or1KuKN4RKS/+L4E2I8RzQwzLzMLYZPh1O7YjB7SJe0x+2Pg4eMxUbPdiGjzDkEracPC/u/aeAWhGxWyOhSWaYxkPfL77WDuWfMD1siKA3+zzU8NC6mn4MEZMqSMrYRJoTA2ab6WCmtAAjXYcVEO/O/waG4DJI1j7kiB08= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1710502745; c=relaxed/simple; bh=e1y/a3hAt3iIY1eG/bhFWCCip3ImzDp68z3R3ZufW3k=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=Xwzu25MZ2ZjUIli76vBHaHNkUeXa7oMbHKbxFd8ku3r0kSdrLLp+D/l3HiJ16RWg3dkrLFgYwhK4RqoXAlDWyobuhO+rf9RIuCj8WJWooAgx8PAf5BiPeoS5FxJmNS2rM1MBg/66HaZicNuPpi1moaR3AV8j1Bylf+64+M2PYEk= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=googlemail.com; spf=pass smtp.mailfrom=googlemail.com; dkim=pass (2048-bit key) header.d=googlemail.com header.i=@googlemail.com header.b=m+EyuCEe; arc=none smtp.client-ip=209.85.218.53 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=googlemail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=googlemail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=googlemail.com header.i=@googlemail.com header.b="m+EyuCEe" Received: by mail-ej1-f53.google.com with SMTP id a640c23a62f3a-a3ddc13bbb3so562203166b.0; Fri, 15 Mar 2024 04:39:03 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlemail.com; s=20230601; t=1710502742; x=1711107542; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=ajSGsc6A/F/qkby1cV3DFijz3ujuoh7yFblhBSAWTk4=; b=m+EyuCEesIsDuGQ6AVn09GFl/Sc9Nd1IwniLlBRMSQlyFvpRQe/06nj77PnnEloORY ZSUZVXKOoAejW0/VB00UtZf6ZSbeD7uZzmqOzZV1T/1uIM3sB/aIuDjGDvyE6YnP4Fmr CBsKffMJAUEBZHNoPqPBsq+8XqN0JvTmBZrvp3biKpN+F9AxuvgpmCAIYK6+4pLBnXPH gpWTMbfeiTGUUiKu/sTJij2ePn5wtuqpfISjV/bRnlHOXgMKEpJV+Yj9eWkSExR6gmr8 Wqu6i3pvXzzEfNsZ1cHXYDlN7u55voEv/tYewWcx49jKZgN4M7rurZB9+xf8KufXt1di dkvw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1710502742; x=1711107542; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=ajSGsc6A/F/qkby1cV3DFijz3ujuoh7yFblhBSAWTk4=; b=m2i20SLJ95nNtHMNV1/ybL3sZmOpq+j7FDhPe2un2YG1+HKFT1hsqT/k2KGh1cx92t FKeVy+mv3Tf/KT1bGmI2nKVZrmeXWV9mgnD+gobrHBNY8ieS1nM3Xg7f7hwakku6kuL9 g7gKPZOUG874dQJxz/RW0FKLmCiQffDPgphsY2upx1/0KzxiGr4qin4Y8ZNDuwIGoXCZ pCYAUkAJn2YXS2OBCmWyEHG2H1DOnqF35AAGf4OJJTHDcyLMMzjaIWEiZJFoJrallF8E /062jBqZ+bYLQYlg8jrWjBQS5XV1rXeT/F7a/d3UCYLzObCK9k6gN6Vc7IEh9HNzssaz Gtlg== X-Forwarded-Encrypted: i=1; AJvYcCU/u5xN97DqJsbxo/nBXCIhGdoK1TTMq11OvhNMcT1+NhREQal9tXbhUtGsp2her+EIccgs8RFBhbeC7GtuongHLOcx5VYALuN7NUcqQLRecxRzPQDKlPQfqSfGfeFnE6x2+PlfUdhG3HwCDYZlOOwXgaCbDVGBCHqdBweNDkt6W2x6UYEh7yu9A6Np9B89NwftCbbMeQ== X-Gm-Message-State: AOJu0Yw30OxrMnn6dC7TIntAxALHSWajHgjtbL/snVeqf7ro73gHFDHq GuNDRrxxrDXLGjw5jSxqmoqawMJu3NzGbP2jMebzidmV1w336KcmuI0DRKaVjvUlcQ== X-Google-Smtp-Source: AGHT+IHJJjdK95FxiFWtuKqFb5okKLCX+Xl17xr9ZeV/oMTb5MlWFKMC//tYf9kBKFRK8DaZbTEwfQ== X-Received: by 2002:a17:906:1501:b0:a45:d7fb:8423 with SMTP id b1-20020a170906150100b00a45d7fb8423mr7825935ejd.9.1710502741739; Fri, 15 Mar 2024 04:39:01 -0700 (PDT) Received: from ddev.DebianHome (dynamic-095-119-217-226.95.119.pool.telefonica.de. [95.119.217.226]) by smtp.gmail.com with ESMTPSA id fg3-20020a056402548300b005682f47aea7sm1610024edb.94.2024.03.15.04.39.00 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 15 Mar 2024 04:39:01 -0700 (PDT) From: =?utf-8?q?Christian_G=C3=B6ttsche?= To: linux-security-module@vger.kernel.org Cc: Alexander Gordeev , Felix Kuehling , Alex Deucher , =?utf-8?q?Christian_K=C3=B6nig?= , "Pan, Xinhui" , David Airlie , Daniel Vetter , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Stefan Haberland , Jan Hoeppner , Heiko Carstens , Vasily Gorbik , Christian Borntraeger , Sven Schnelle , Mark Brown , Greg Kroah-Hartman , "Jiri Slaby (SUSE)" , amd-gfx@lists.freedesktop.org, dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, linux-s390@vger.kernel.org, bpf@vger.kernel.org Subject: [PATCH 05/10] drivers: use new capable_any functionality Date: Fri, 15 Mar 2024 12:37:26 +0100 Message-ID: <20240315113828.258005-5-cgzones@googlemail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20240315113828.258005-1-cgzones@googlemail.com> References: <20240315113828.258005-1-cgzones@googlemail.com> Precedence: bulk X-Mailing-List: linux-security-module@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Use the new added capable_any function in appropriate cases, where a task is required to have any of two capabilities. Reorder CAP_SYS_ADMIN last. Signed-off-by: Christian Göttsche Acked-by: Alexander Gordeev (s390 portion) Acked-by: Felix Kuehling (amdkfd portion) --- v4: Additional usage in kfd_ioctl() v3: rename to capable_any() --- drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 3 +-- drivers/net/caif/caif_serial.c | 2 +- drivers/s390/block/dasd_eckd.c | 2 +- 3 files changed, 3 insertions(+), 4 deletions(-) diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c index dfa8c69532d4..8c7ebca01c17 100644 --- a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c +++ b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c @@ -3290,8 +3290,7 @@ static long kfd_ioctl(struct file *filep, unsigned int cmd, unsigned long arg) * more priviledged access. */ if (unlikely(ioctl->flags & KFD_IOC_FLAG_CHECKPOINT_RESTORE)) { - if (!capable(CAP_CHECKPOINT_RESTORE) && - !capable(CAP_SYS_ADMIN)) { + if (!capable_any(CAP_CHECKPOINT_RESTORE, CAP_SYS_ADMIN)) { retcode = -EACCES; goto err_i1; } diff --git a/drivers/net/caif/caif_serial.c b/drivers/net/caif/caif_serial.c index ed3a589def6b..e908b9ce57dc 100644 --- a/drivers/net/caif/caif_serial.c +++ b/drivers/net/caif/caif_serial.c @@ -326,7 +326,7 @@ static int ldisc_open(struct tty_struct *tty) /* No write no play */ if (tty->ops->write == NULL) return -EOPNOTSUPP; - if (!capable(CAP_SYS_ADMIN) && !capable(CAP_SYS_TTY_CONFIG)) + if (!capable_any(CAP_SYS_TTY_CONFIG, CAP_SYS_ADMIN)) return -EPERM; /* release devices to avoid name collision */ diff --git a/drivers/s390/block/dasd_eckd.c b/drivers/s390/block/dasd_eckd.c index 373c1a86c33e..8f9a5136306a 100644 --- a/drivers/s390/block/dasd_eckd.c +++ b/drivers/s390/block/dasd_eckd.c @@ -5384,7 +5384,7 @@ static int dasd_symm_io(struct dasd_device *device, void __user *argp) char psf0, psf1; int rc; - if (!capable(CAP_SYS_ADMIN) && !capable(CAP_SYS_RAWIO)) + if (!capable_any(CAP_SYS_RAWIO, CAP_SYS_ADMIN)) return -EACCES; psf0 = psf1 = 0; From patchwork Fri Mar 15 11:37:27 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Christian_G=C3=B6ttsche?= X-Patchwork-Id: 13593350 X-Patchwork-Delegate: paul@paul-moore.com Received: from mail-ed1-f43.google.com (mail-ed1-f43.google.com [209.85.208.43]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4E3D11CA82; Fri, 15 Mar 2024 11:39:04 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.208.43 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1710502746; cv=none; b=mA4Zl7F+fMJstBKm95fTMU7hp1nJXGXQ4raGdkUeSdnuimd+RxNUGY83HjV04LEuHSDs3YQGaBMpdLdbHeaamwCJ5m9f1PhObDGTPD00OHutROJXjFEEhDod+Erhg0ARvKonLq7C+Qs7qxFXzS5TCrAjHHqUFa/0Z2AIjLgbCXM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1710502746; c=relaxed/simple; bh=9tCjsbVJ/fo/2whI+Hw22WMDXZdhrVzR/9TP7a13ecA=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=jW0iOhV0RPioUOs/NsXcfMb9cM/ueZNNmsS8C8rT17swHH89P40H8Lp+/lVq6YPMxgZLM15Pp7gF+qPGxmk5tLRu7wpZHMEIjC5y9E5Jm7FlALZEpHEeWbnN3hxV36crJ7iS1Va04iEf210WUJiDXLTyc4a5aF+5SJJ0S8He/m4= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=googlemail.com; spf=pass smtp.mailfrom=googlemail.com; dkim=pass (2048-bit key) header.d=googlemail.com header.i=@googlemail.com header.b=S/Aww/rt; arc=none smtp.client-ip=209.85.208.43 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=googlemail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=googlemail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=googlemail.com header.i=@googlemail.com header.b="S/Aww/rt" Received: by mail-ed1-f43.google.com with SMTP id 4fb4d7f45d1cf-563c595f968so2578956a12.0; Fri, 15 Mar 2024 04:39:04 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlemail.com; s=20230601; t=1710502742; x=1711107542; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=GqSJTvrldRF8cbM7TJxtJrnkF01DJRZddF+rymqV+ys=; b=S/Aww/rtWdgBKiueou8NEiS1coXOCisoDZJU5P+IDO9Akh2MgblpknjLJSEDWzhz4n c85iB7gOBvZMpVvdZiaiOicp9oqVdx68ARJI9OY/5zzL7+LmhXTCaw3DpaDRTWAkAD+o MPXyx5AQngEzjogSG/XSAK+X8h76n5zY3RiKfZURzZoTjkHhPU7AbzQs7Alpty+OOoOf QHW/OPBEZWREcdU1rRbqg//Q43J1C7ac4QMUqO04pC39nYJzapDBZJBstfMIJpTmRQtk TP1RzJgZs6ttLQ07rFYnu9vudaueeRuRwer/y6GmqBg1lw11mA8SBixRxIQeLQVzmpiD FDjg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1710502742; x=1711107542; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=GqSJTvrldRF8cbM7TJxtJrnkF01DJRZddF+rymqV+ys=; b=dkOmJhAfAZ1vaDLE18HwdH1FbUTIOIrB+GQX5nQh6hcwnot0cncd3azgOLtVNAu/RB c9WBNMOos3rAuZ+JKYsm3SfTRqEp2MkvB9x3AH9W8zfYeciJjLhOdqCgtwVRUKEcFEAA WUqQ31WS/m4Jm0Yr39VBT2GnNyVMr5NpERFS6XXN6YxpzGqewfD5aox5XERaMwvt7Gja MsjJkS2BUbfgJ4cCqVQ9xEF93VG9QV2m0x3wwl4Mg34ENipNcTskbz/2hxlXh5g54Dqu rkBrNwSFYlGOLYH4O3raMh0rfaaG3FYr4ttEOeS3PUHCfFOUc8YoRxzLj5E14AU79QFN 9XhA== X-Forwarded-Encrypted: i=1; AJvYcCW/RmdL0zRYEnIiF67es9izmA8nnB7dy+77Ps6RsWDRJlZXpemgW5h3tXl7uDGyY7iLAwf+74iG+Z35n8lh/xDEdmeIlmZoZLmlOXSZcUjeEqZ/ES32sQ9zS8RBgqvImVCf2ltWFpQWa5npWXylG3sIHZZixECzTwkeCzJNsoCrfw== X-Gm-Message-State: AOJu0YxaIGnsCYcmAkiORgOjVdKRulr/iIfyYANzlY/WPrGn3xjkhHTh z3iy952e6tbFTfml8LZfqkgFz8Ep2ZqhnJb8jyR8TKAb7BjUi9BmVqw5rOboE8ganQ== X-Google-Smtp-Source: AGHT+IHVrm+oaqT4IHcuat6PtAnzsvv3PZGBlHGbf+6XCYTlxZd2pqsN/rkNVVex9ofvPc0Zr06h/A== X-Received: by 2002:a05:6402:612:b0:568:1983:4913 with SMTP id n18-20020a056402061200b0056819834913mr2376571edv.23.1710502742568; Fri, 15 Mar 2024 04:39:02 -0700 (PDT) Received: from ddev.DebianHome (dynamic-095-119-217-226.95.119.pool.telefonica.de. [95.119.217.226]) by smtp.gmail.com with ESMTPSA id fg3-20020a056402548300b005682f47aea7sm1610024edb.94.2024.03.15.04.39.01 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 15 Mar 2024 04:39:02 -0700 (PDT) From: =?utf-8?q?Christian_G=C3=B6ttsche?= To: linux-security-module@vger.kernel.org Cc: Christian Brauner , Alexander Viro , Jan Kara , linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org, bpf@vger.kernel.org Subject: [PATCH 06/10] fs: use new capable_any functionality Date: Fri, 15 Mar 2024 12:37:27 +0100 Message-ID: <20240315113828.258005-6-cgzones@googlemail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20240315113828.258005-1-cgzones@googlemail.com> References: <20240315113828.258005-1-cgzones@googlemail.com> Precedence: bulk X-Mailing-List: linux-security-module@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Use the new added capable_any function in appropriate cases, where a task is required to have any of two capabilities. Signed-off-by: Christian Göttsche Acked-by: Christian Brauner --- v3: rename to capable_any() --- fs/pipe.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/pipe.c b/fs/pipe.c index 50c8a8596b52..9d02698ed5d4 100644 --- a/fs/pipe.c +++ b/fs/pipe.c @@ -784,7 +784,7 @@ bool too_many_pipe_buffers_hard(unsigned long user_bufs) bool pipe_is_unprivileged_user(void) { - return !capable(CAP_SYS_RESOURCE) && !capable(CAP_SYS_ADMIN); + return !capable_any(CAP_SYS_RESOURCE, CAP_SYS_ADMIN); } struct pipe_inode_info *alloc_pipe_info(void) From patchwork Fri Mar 15 11:37:28 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Christian_G=C3=B6ttsche?= X-Patchwork-Id: 13593351 X-Patchwork-Delegate: paul@paul-moore.com Received: from mail-ed1-f48.google.com (mail-ed1-f48.google.com [209.85.208.48]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9BF7C1E4A6; Fri, 15 Mar 2024 11:39:05 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.208.48 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1710502747; cv=none; b=aKTXB4Sz5gU1sG+Y9Z4K3PzFZTdjtuRVKLDcW4zaEl10Hl2fusgFOs7eg8qWJs9SyFleA9g4Ba1QAlhkNMto+4IZQgevhTRKRy7MeAi9cD2Q4a9IkZ4ywOFFSizZONsXDdp/Tdc29Ztr3MOjLxms4F4JhgW+TIaRcqp95TsiVnM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1710502747; c=relaxed/simple; bh=SGbM8zfCNboFS2Tv1SvFRCpvBhbIOFnNPOkzkFdW9ko=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=hOEk1B5LCe64+d5AnRJXN7oouuPdX7GiGEaVWnSoLW1Lky0VzjKAgg5ezfuxYFsiJXc4ZiJqRioHI40WjFVqypAwcwJeWeeWl+SAgwdHeCl/VNm+XQ+v06CANloqjMB7hHJdMbv934I3wwqZI9uwuF6gqbZPsdazFZrFqsM3tT4= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=googlemail.com; spf=pass smtp.mailfrom=googlemail.com; dkim=pass (2048-bit key) header.d=googlemail.com header.i=@googlemail.com header.b=k2dDmT9v; arc=none smtp.client-ip=209.85.208.48 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=googlemail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=googlemail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=googlemail.com header.i=@googlemail.com header.b="k2dDmT9v" Received: by mail-ed1-f48.google.com with SMTP id 4fb4d7f45d1cf-563bb51c36eso2537206a12.2; Fri, 15 Mar 2024 04:39:05 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlemail.com; s=20230601; t=1710502744; x=1711107544; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=4o/PLmolwqQui1v9BtbvmoTXcWRlKh99YDBIUOT6h3E=; b=k2dDmT9v2Bdn6jke46j+uNxkDTh/Mr+IhcLuDl03QMAaRSoXjG9pDBdhcmxEQTeyOu 0AinhVKuvrukGvuwa4b4AbaH1lEub4DlbG1ek4rYL3xF4nLH6bMfKiB7uUuPZ7Cd6Ybs L+U+IjO2asxdHDg0RuoLHpsR8mxycp8bV32vzmJqAejs5RN0M54Fzt8rd8f/DYP0STMj gG1s8ptPKGKYgaEqb3eqVLI+q30UU9L50/cZ33xmhAIwdwS68P76ZpsQ23badgtDKonZ YW/kiEBIRfFBVT/ylOf3HbxXMBHGgM6k0ylrvXh+ZdJFBLAJXuHSWAUSo12kawZpx8Jq c3fg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1710502744; x=1711107544; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=4o/PLmolwqQui1v9BtbvmoTXcWRlKh99YDBIUOT6h3E=; b=hRYXihg0VJwAa25vsKZMVDRK0vpkUC8nAxLPaDvKDGxPl5nqNYv9fAcygzdBA6sit1 ReDKONIcrvmOFqa5UrOzRCdQ+56ZS81A4pGGsx1i9mPytdRdpSLy3z1e6pDUTfe1mu/i pMKvuYvGg0rWO/yo7/6YPtNG/kobBXn4JZL1rwALY8BR7qVCLzYt2TMzpbuch/3rw1pX wilQ054lmSucrvPQX6qxUchR16/F5Aft5oyHm8el0jh9ygi8cJD0vAopt3bPVyfOLZYz 0WnDgSMQNDhmOkIKHzuyUK0/IvRuDlVhYlMy4zBHjsPgygG7qIHv1kkrIhE4ReuNxGDV f+ow== X-Forwarded-Encrypted: i=1; AJvYcCUeI4KufGjOTsA3SbKaYwFcYFge8MZGVr0cclQA+508NiR+2Fo7HdHPHDGB/s1XGND0SPankAgs7nQyo4YZsIbuu/65pgj7TQ0gp5fCTJsLZAAF+og9bDEAIrnMJag1c/w0 X-Gm-Message-State: AOJu0YzUQfs9fnaV7q79hEBZYMr9pB6LBND7q28dfukRQeo0hgLfMEi8 qs+abMT2Ssb1fvvwyG7aPyGWiVKyHRx+Gl1zMpDEMO0J4ANZSKSMXwHJEHDDShWphw== X-Google-Smtp-Source: AGHT+IFssJXK7fUBhPEWYJ4FZnZi94EshcyFHVKx/OmG5S34CCy31+hNK0pm83Gmc3J2FTlMeFZ6Yg== X-Received: by 2002:a05:6402:3981:b0:568:9b13:77fe with SMTP id fk1-20020a056402398100b005689b1377femr3968225edb.37.1710502744061; Fri, 15 Mar 2024 04:39:04 -0700 (PDT) Received: from ddev.DebianHome (dynamic-095-119-217-226.95.119.pool.telefonica.de. [95.119.217.226]) by smtp.gmail.com with ESMTPSA id fg3-20020a056402548300b005682f47aea7sm1610024edb.94.2024.03.15.04.39.03 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 15 Mar 2024 04:39:03 -0700 (PDT) From: =?utf-8?q?Christian_G=C3=B6ttsche?= To: linux-security-module@vger.kernel.org Cc: Christian Brauner , Andrew Morton , Suren Baghdasaryan , Oleg Nesterov , Tycho Andersen , Mateusz Guzik , Nicholas Piggin , Peng Zhang , Heiko Carstens , linux-kernel@vger.kernel.org, bpf@vger.kernel.org Subject: [PATCH 07/10] kernel: use new capable_any functionality Date: Fri, 15 Mar 2024 12:37:28 +0100 Message-ID: <20240315113828.258005-7-cgzones@googlemail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20240315113828.258005-1-cgzones@googlemail.com> References: <20240315113828.258005-1-cgzones@googlemail.com> Precedence: bulk X-Mailing-List: linux-security-module@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Use the new added capable_any function in appropriate cases, where a task is required to have any of two capabilities. Signed-off-by: Christian Göttsche Reviewed-by: Christian Brauner Reviewed-by: Tycho Andersen --- v3: rename to capable_any() --- kernel/fork.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/fork.c b/kernel/fork.c index 39a5046c2f0b..645ab8060407 100644 --- a/kernel/fork.c +++ b/kernel/fork.c @@ -2257,7 +2257,7 @@ __latent_entropy struct task_struct *copy_process( retval = -EAGAIN; if (is_rlimit_overlimit(task_ucounts(p), UCOUNT_RLIMIT_NPROC, rlimit(RLIMIT_NPROC))) { if (p->real_cred->user != INIT_USER && - !capable(CAP_SYS_RESOURCE) && !capable(CAP_SYS_ADMIN)) + !capable_any(CAP_SYS_RESOURCE, CAP_SYS_ADMIN)) goto bad_fork_cleanup_count; } current->flags &= ~PF_NPROC_EXCEEDED; From patchwork Fri Mar 15 11:37:29 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Christian_G=C3=B6ttsche?= X-Patchwork-Id: 13593352 X-Patchwork-Delegate: paul@paul-moore.com Received: from mail-lf1-f53.google.com (mail-lf1-f53.google.com [209.85.167.53]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7EB4C36B15; Fri, 15 Mar 2024 11:39:09 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.167.53 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1710502751; cv=none; b=Qk3BeWUmizX9MdwR3KgBxrJ0gNCSTz2NT6KCxnhqC20DFb/cDOYPDkQIRUh9r+zTNFXhzjWxlJnFVRIxaSPx+DSIFi62V29ORmk3E2COZsKPa1dzzNNQ4tF+Yi6pbZGB5YxYHHvQwd3d92+n2HU6zjKBo6hlLGZjjMlQlYbFtCw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1710502751; c=relaxed/simple; bh=v58AhsmmQT/EbyS8YFz+dOXWE+1LCHneaLwzLK8avl8=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=T3bs5N+earuqQsw3+5hXSH5Nwsss8aCIBxtKHHxqsSZr6Pq6qqaVvKt8IIoc2PGbYx59xETqvGuvt/xUE4lRPbDoMIzX04UMeE/mK5svJn9SowhuvkJLdqcy7lGZ5c9++OA0zhlTszpkgI081tnqaqnkUbREEWYF9ZsZ+AVNFks= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=googlemail.com; spf=pass smtp.mailfrom=googlemail.com; dkim=pass (2048-bit key) header.d=googlemail.com header.i=@googlemail.com header.b=iz5jHFZq; arc=none smtp.client-ip=209.85.167.53 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=googlemail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=googlemail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=googlemail.com header.i=@googlemail.com header.b="iz5jHFZq" Received: by mail-lf1-f53.google.com with SMTP id 2adb3069b0e04-513da1c1f26so803715e87.3; Fri, 15 Mar 2024 04:39:09 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlemail.com; s=20230601; t=1710502748; x=1711107548; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=Oep7fiSPFUB4mUGU2hN2D+vBrhzRF1VLsba4TSKYhR0=; b=iz5jHFZqVQ7paGV1QpmDKiLWSD0Qr2vOihEIItoQDzGZjUoH7px4N8/n0ZpRmeopFm OUfgbXaltNyWUtewR8Ec62PT0OMd7Ef+kZKkX1Db5/ylvhlB4zSjP5lxtDnIwz4kukXc i2RcvbrwpzBA2pedj90ZTg03x4Y3WCmB+DtjMbA0+XEeaRIEr/9gYYGBmqiLn7ZTIeSv JeTxXCh2fcPgquUBsy/Hu/HLnPR+o0XRY/yC46ALY3N265DGu/vkU1ZC4mmGa9k3nuq+ MemcWkJ4AXol56UOQ+NNgl8ji0gYS1PdQjUY9Uca+v2RANtu+4/qO0Po1f7zpYEfNW4c 37ew== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1710502748; x=1711107548; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=Oep7fiSPFUB4mUGU2hN2D+vBrhzRF1VLsba4TSKYhR0=; b=AuixkN+UFFA71GTOPPqxV/Qs3lLjeLM+Kpg8pi2MkfSesgme4hxogXko9VlY3qkmnx lx8AQV0fJWk9wSLRUZFbOnxcOcwipO6eXia332wtUYqFqfksFhodq0SOXfSmZn8ZypbB yIXp8IHlZWgz06JOZMZwLAFlc4/79adY/QCfqvYHbxbs8g3GtOZbuxWZNz7BizV+tGbv /yNB+JF+iurLCih5hkkXSmOzRCM2hBTUORp5RMMAVOA/wEpfzFFWoOvRx2u2r6c40qv7 AAW4FiOtpvoayJy2r0dLnXhU2XM8Dj8ZYOFhd1ycIKgnEKn8eLHbJfo/Q5uVOs/obdR5 TTvg== X-Forwarded-Encrypted: i=1; AJvYcCUXGOnskgvZP8AkqENjQmuBndmxCaOrtTKBOSgZVOvM3ikpzE83vma+fq9vkbxozkLwAmE+7tvFAzBZTDGWGIOtfqXixd6fd0La7gIWJeHFBkUAvI1WRdWasNEnnofVh11VE1eqwfnzxCPM+ReqjTA463sHoBXoJYWyHvoMdeIXL+l6e+IizBkx0Qs42CzyNFeWunn+6A== X-Gm-Message-State: AOJu0YxT3NS4yotcAiIbc0w+vYJOG1DPsZwBSRczNsOxvkKx4YytdRBB twi2zScNwApSUV/hD/27n0wvUYfWZMGk3sHhi9Mo7Z7dcFwEkV8h98VEJtPLq8uG2g== X-Google-Smtp-Source: AGHT+IH2SgThAHXr+8wzksbodsMSKaWmVuuNHL/aCI6V/7GnUQ8/ngvOSLVSaHYnNCgiKx6GrAZoQA== X-Received: by 2002:a2e:a7c4:0:b0:2d4:83f9:2e21 with SMTP id x4-20020a2ea7c4000000b002d483f92e21mr1975031ljp.42.1710502747344; Fri, 15 Mar 2024 04:39:07 -0700 (PDT) Received: from ddev.DebianHome (dynamic-095-119-217-226.95.119.pool.telefonica.de. [95.119.217.226]) by smtp.gmail.com with ESMTPSA id fg3-20020a056402548300b005682f47aea7sm1610024edb.94.2024.03.15.04.39.06 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 15 Mar 2024 04:39:06 -0700 (PDT) From: =?utf-8?q?Christian_G=C3=B6ttsche?= To: linux-security-module@vger.kernel.org Cc: Miquel Raynal , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Alexander Aring , Stefan Schmidt , David Ahern , David Howells , Marc Kleine-Budde , Kuniyuki Iwashima , Abel Wu , Breno Leitao , Alexander Mikhalitsyn , John Fastabend , Daan De Meyer , netdev@vger.kernel.org, linux-kernel@vger.kernel.org, linux-wpan@vger.kernel.org, bpf@vger.kernel.org Subject: [PATCH 08/10] net: use new capable_any functionality Date: Fri, 15 Mar 2024 12:37:29 +0100 Message-ID: <20240315113828.258005-8-cgzones@googlemail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20240315113828.258005-1-cgzones@googlemail.com> References: <20240315113828.258005-1-cgzones@googlemail.com> Precedence: bulk X-Mailing-List: linux-security-module@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Use the new added capable_any function in appropriate cases, where a task is required to have any of two capabilities. Add sock_ns_capable_any() wrapper similar to existing sock_ns_capable() one. Reorder CAP_SYS_ADMIN last. Signed-off-by: Christian Göttsche Reviewed-by: Miquel Raynal (ieee802154 portion) --- v4: - introduce sockopt_ns_capable_any() v3: - rename to capable_any() - make use of ns_capable_any --- include/net/sock.h | 1 + net/caif/caif_socket.c | 2 +- net/core/sock.c | 15 +++++++++------ net/ieee802154/socket.c | 6 ++---- net/ipv4/ip_sockglue.c | 5 +++-- net/ipv6/ipv6_sockglue.c | 3 +-- net/unix/af_unix.c | 2 +- 7 files changed, 18 insertions(+), 16 deletions(-) diff --git a/include/net/sock.h b/include/net/sock.h index b5e00702acc1..2e64a80c8fca 100644 --- a/include/net/sock.h +++ b/include/net/sock.h @@ -1736,6 +1736,7 @@ static inline void unlock_sock_fast(struct sock *sk, bool slow) void sockopt_lock_sock(struct sock *sk); void sockopt_release_sock(struct sock *sk); bool sockopt_ns_capable(struct user_namespace *ns, int cap); +bool sockopt_ns_capable_any(struct user_namespace *ns, int cap1, int cap2); bool sockopt_capable(int cap); /* Used by processes to "lock" a socket state, so that diff --git a/net/caif/caif_socket.c b/net/caif/caif_socket.c index 039dfbd367c9..2d811037e378 100644 --- a/net/caif/caif_socket.c +++ b/net/caif/caif_socket.c @@ -1026,7 +1026,7 @@ static int caif_create(struct net *net, struct socket *sock, int protocol, .usersize = sizeof_field(struct caifsock, conn_req.param) }; - if (!capable(CAP_SYS_ADMIN) && !capable(CAP_NET_ADMIN)) + if (!capable_any(CAP_NET_ADMIN, CAP_SYS_ADMIN)) return -EPERM; /* * The sock->type specifies the socket type to use. diff --git a/net/core/sock.c b/net/core/sock.c index 43bf3818c19e..fa9edcc3e23d 100644 --- a/net/core/sock.c +++ b/net/core/sock.c @@ -1077,6 +1077,12 @@ bool sockopt_ns_capable(struct user_namespace *ns, int cap) } EXPORT_SYMBOL(sockopt_ns_capable); +bool sockopt_ns_capable_any(struct user_namespace *ns, int cap1, int cap2) +{ + return has_current_bpf_ctx() || ns_capable_any(ns, cap1, cap2); +} +EXPORT_SYMBOL(sockopt_ns_capable_any); + bool sockopt_capable(int cap) { return has_current_bpf_ctx() || capable(cap); @@ -1118,8 +1124,7 @@ int sk_setsockopt(struct sock *sk, int level, int optname, switch (optname) { case SO_PRIORITY: if ((val >= 0 && val <= 6) || - sockopt_ns_capable(sock_net(sk)->user_ns, CAP_NET_RAW) || - sockopt_ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN)) { + sockopt_ns_capable_any(sock_net(sk)->user_ns, CAP_NET_RAW, CAP_NET_ADMIN)) { sock_set_priority(sk, val); return 0; } @@ -1422,8 +1427,7 @@ int sk_setsockopt(struct sock *sk, int level, int optname, break; case SO_MARK: - if (!sockopt_ns_capable(sock_net(sk)->user_ns, CAP_NET_RAW) && - !sockopt_ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN)) { + if (!sockopt_ns_capable_any(sock_net(sk)->user_ns, CAP_NET_RAW, CAP_NET_ADMIN)) { ret = -EPERM; break; } @@ -2813,8 +2817,7 @@ int __sock_cmsg_send(struct sock *sk, struct cmsghdr *cmsg, switch (cmsg->cmsg_type) { case SO_MARK: - if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_RAW) && - !ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN)) + if (!ns_capable_any(sock_net(sk)->user_ns, CAP_NET_RAW, CAP_NET_ADMIN)) return -EPERM; if (cmsg->cmsg_len != CMSG_LEN(sizeof(u32))) return -EINVAL; diff --git a/net/ieee802154/socket.c b/net/ieee802154/socket.c index 990a83455dcf..42b3b12eb493 100644 --- a/net/ieee802154/socket.c +++ b/net/ieee802154/socket.c @@ -902,8 +902,7 @@ static int dgram_setsockopt(struct sock *sk, int level, int optname, ro->want_lqi = !!val; break; case WPAN_SECURITY: - if (!ns_capable(net->user_ns, CAP_NET_ADMIN) && - !ns_capable(net->user_ns, CAP_NET_RAW)) { + if (!ns_capable_any(net->user_ns, CAP_NET_ADMIN, CAP_NET_RAW)) { err = -EPERM; break; } @@ -926,8 +925,7 @@ static int dgram_setsockopt(struct sock *sk, int level, int optname, } break; case WPAN_SECURITY_LEVEL: - if (!ns_capable(net->user_ns, CAP_NET_ADMIN) && - !ns_capable(net->user_ns, CAP_NET_RAW)) { + if (!ns_capable_any(net->user_ns, CAP_NET_ADMIN, CAP_NET_RAW)) { err = -EPERM; break; } diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c index cf377377b52d..5a1e5ee20ddd 100644 --- a/net/ipv4/ip_sockglue.c +++ b/net/ipv4/ip_sockglue.c @@ -1008,8 +1008,9 @@ int do_ip_setsockopt(struct sock *sk, int level, int optname, inet_assign_bit(MC_ALL, sk, val); return 0; case IP_TRANSPARENT: - if (!!val && !sockopt_ns_capable(sock_net(sk)->user_ns, CAP_NET_RAW) && - !sockopt_ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN)) + if (!!val && + !sockopt_ns_capable_any(sock_net(sk)->user_ns, + CAP_NET_RAW, CAP_NET_ADMIN)) return -EPERM; if (optlen < 1) return -EINVAL; diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c index d4c28ec1bc51..e46b11b5d3dd 100644 --- a/net/ipv6/ipv6_sockglue.c +++ b/net/ipv6/ipv6_sockglue.c @@ -773,8 +773,7 @@ int do_ipv6_setsockopt(struct sock *sk, int level, int optname, break; case IPV6_TRANSPARENT: - if (valbool && !sockopt_ns_capable(net->user_ns, CAP_NET_RAW) && - !sockopt_ns_capable(net->user_ns, CAP_NET_ADMIN)) { + if (valbool && !sockopt_ns_capable_any(net->user_ns, CAP_NET_RAW, CAP_NET_ADMIN)) { retv = -EPERM; break; } diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c index 5b41e2321209..acc36b2d25d7 100644 --- a/net/unix/af_unix.c +++ b/net/unix/af_unix.c @@ -1783,7 +1783,7 @@ static inline bool too_many_unix_fds(struct task_struct *p) struct user_struct *user = current_user(); if (unlikely(READ_ONCE(user->unix_inflight) > task_rlimit(p, RLIMIT_NOFILE))) - return !capable(CAP_SYS_RESOURCE) && !capable(CAP_SYS_ADMIN); + return !capable_any(CAP_SYS_RESOURCE, CAP_SYS_ADMIN); return false; } From patchwork Fri Mar 15 11:37:30 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Christian_G=C3=B6ttsche?= X-Patchwork-Id: 13593353 X-Patchwork-Delegate: paul@paul-moore.com Received: from mail-ed1-f53.google.com (mail-ed1-f53.google.com [209.85.208.53]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CA8FF37157; Fri, 15 Mar 2024 11:39:09 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.208.53 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1710502752; cv=none; b=iurlLpIyu3BAEjM9LPHhyhf2DcVRbKcuxFnfKLE/noh3JYE+Wz7AUb8VFZz9rZgDPhuSCGpDhcpP4xhtBX6McUfhe0aAKjj4m6A/vaUwPm6G/sswfqc3k3/9MYa9eJYEHrWAMFkuhO9/FUOfPSdXBJ6udmyPQzBstK8x4IjsAjs= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1710502752; c=relaxed/simple; bh=HmfrjKV80zxN0Qu8spZWjiP4Pz/wzBkFw6jKJtLTo9s=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=PIJynGL/w8EycqHA237ihCI0bTeuNVnH0f8xQMkhdhJW3CpFD28ppZBeE8fvlINcC1ObmVrYes8AjPelHpiA40/W0Rkuch8fssg971g/xJZ+4jwMLgnkc6vYAqJqZ9jkg5i5L1Mvr+96htkOt0c/2auu4qPBpSs1/iGIaE9LN1Y= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=googlemail.com; spf=pass smtp.mailfrom=googlemail.com; dkim=pass (2048-bit key) header.d=googlemail.com header.i=@googlemail.com header.b=ejCgNeoc; arc=none smtp.client-ip=209.85.208.53 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=googlemail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=googlemail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=googlemail.com header.i=@googlemail.com header.b="ejCgNeoc" Received: by mail-ed1-f53.google.com with SMTP id 4fb4d7f45d1cf-56829f41f81so2669901a12.2; Fri, 15 Mar 2024 04:39:09 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlemail.com; s=20230601; t=1710502748; x=1711107548; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=XFW6eqfgwfb8L9+rUjWWkl22JgKTa/YmYo+cAr3MkEM=; b=ejCgNeochwlWc1477r/Z4g5HRldUx+/xKBMuw+6eimumDjMPr5pAhXBdxorIEVvm7o WUrhAxDQCzF3X3SVCcqcLOjuoz6l3QvkBJd7ff5OCwwmNWFd+QjZqmd2graR/VGQ7qCk AxeEWng52fYRtUvz+LgbqMEQF0zww3216vJBkA7Ls0XxmWwQWmF633ZpEq3U1mgKQYku Zw7UpvKIH+PRajkQzP24AYk92WbCmpOpe/0nHzYV/JmRjj7l+5837Rd53Yr90x61rxtb ZMaoAffMM746MLoupJZQAXUxJgIAq4aYAtGVgwlsEb34/er5kLDMiOcJ568yLmrGLZMW 6pLw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1710502748; x=1711107548; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=XFW6eqfgwfb8L9+rUjWWkl22JgKTa/YmYo+cAr3MkEM=; b=pyuB02cqc+cUQf61kJsrAF874JNZW8D1GZN5Z5N/MXzRU0HwnY+odZArUG8LLgQK2z 8c8FbH+9vZ81Ey+9hdngNbsN5UOw1aGhI3Fxv/go4NCIlNVB0rw8h/Tov9lH/8k82HCm lKogxFfuYL9dWjeMx0mxBpZ9m+sGUQMfV/5Ob4rvQVRoHIEir070NRzdUUqtAKmHlmGs pGUpkeukZe376M6bUf9hR+eMFvTqmPiXH3QaU1RCYt8y2J6PMPaWL8MkjJG5uyrRQ/jp Fda0HDRAQjgWYUBfR7HcV9XY9qFZ5Zc2uymfKLgTZwup/UuXH03cOdX1IL5mpTH90N1F gOgQ== X-Forwarded-Encrypted: i=1; AJvYcCXJJre3NavNEwhP7uLIR/q5iZTuNzzYPoD/O6zdRCbcBZRIFFqYEGWabKtFvOTnaoHEhwpaxxFOrbS7y/LMwJzVj9jVOrZEd4j3+T3Nf7RvBFo/bUlcdZYaXjLQgiLybRtW X-Gm-Message-State: AOJu0Yyf+scyy/EjhOYKz23YtUjsMLCSWRQXfDEegXGAOgQTFIrLg/JN iDfY9Y3UXxlUS7D5O9Hzh/rTmONCJ45fbebm0qEknJIDleI+M4lct0sN3ze+MhG5nw== X-Google-Smtp-Source: AGHT+IEVZU6MeO0L8YmsrZvf54E2m+RHVA6YoaRbvM8QTxq/FR7x8zB9pbUVCGt2gLKWzNCplglUvw== X-Received: by 2002:a05:6402:428b:b0:568:376e:ea2a with SMTP id g11-20020a056402428b00b00568376eea2amr2696148edc.40.1710502748432; Fri, 15 Mar 2024 04:39:08 -0700 (PDT) Received: from ddev.DebianHome (dynamic-095-119-217-226.95.119.pool.telefonica.de. [95.119.217.226]) by smtp.gmail.com with ESMTPSA id fg3-20020a056402548300b005682f47aea7sm1610024edb.94.2024.03.15.04.39.07 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 15 Mar 2024 04:39:08 -0700 (PDT) From: =?utf-8?q?Christian_G=C3=B6ttsche?= To: linux-security-module@vger.kernel.org Cc: Alexei Starovoitov , Daniel Borkmann , Andrii Nakryiko , Martin KaFai Lau , Eduard Zingerman , Song Liu , Yonghong Song , John Fastabend , KP Singh , Stanislav Fomichev , Hao Luo , Jiri Olsa , bpf@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH 09/10] bpf: use new capable_any functionality Date: Fri, 15 Mar 2024 12:37:30 +0100 Message-ID: <20240315113828.258005-9-cgzones@googlemail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20240315113828.258005-1-cgzones@googlemail.com> References: <20240315113828.258005-1-cgzones@googlemail.com> Precedence: bulk X-Mailing-List: linux-security-module@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Use the new added capable_any function in bpf_token_capable() and bpf_net_capable() implementations. Signed-off-by: Christian Göttsche Acked-by: Andrii Nakryiko --- v5: add patch --- include/linux/bpf.h | 2 +- kernel/bpf/syscall.c | 2 +- kernel/bpf/token.c | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/include/linux/bpf.h b/include/linux/bpf.h index 4f20f62f9d63..bdadf3291bec 100644 --- a/include/linux/bpf.h +++ b/include/linux/bpf.h @@ -2701,7 +2701,7 @@ static inline int bpf_obj_get_user(const char __user *pathname, int flags) static inline bool bpf_token_capable(const struct bpf_token *token, int cap) { - return capable(cap) || (cap != CAP_SYS_ADMIN && capable(CAP_SYS_ADMIN)); + return capable_any(cap, CAP_SYS_ADMIN); } static inline void bpf_token_inc(struct bpf_token *token) diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c index ae2ff73bde7e..a10e6f77002c 100644 --- a/kernel/bpf/syscall.c +++ b/kernel/bpf/syscall.c @@ -1175,7 +1175,7 @@ static int map_check_btf(struct bpf_map *map, struct bpf_token *token, static bool bpf_net_capable(void) { - return capable(CAP_NET_ADMIN) || capable(CAP_SYS_ADMIN); + return capable_any(CAP_NET_ADMIN, CAP_SYS_ADMIN); } #define BPF_MAP_CREATE_LAST_FIELD map_token_fd diff --git a/kernel/bpf/token.c b/kernel/bpf/token.c index d6ccf8d00eab..53f491046a8d 100644 --- a/kernel/bpf/token.c +++ b/kernel/bpf/token.c @@ -11,7 +11,7 @@ static bool bpf_ns_capable(struct user_namespace *ns, int cap) { - return ns_capable(ns, cap) || (cap != CAP_SYS_ADMIN && ns_capable(ns, CAP_SYS_ADMIN)); + return ns_capable_any(ns, cap, CAP_SYS_ADMIN); } bool bpf_token_capable(const struct bpf_token *token, int cap) From patchwork Fri Mar 15 11:37:31 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Christian_G=C3=B6ttsche?= X-Patchwork-Id: 13593354 X-Patchwork-Delegate: paul@paul-moore.com Received: from mail-ed1-f44.google.com (mail-ed1-f44.google.com [209.85.208.44]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 760DA374F8; Fri, 15 Mar 2024 11:39:11 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.208.44 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1710502753; cv=none; b=fB2d6dblCSodsQ+TNXJNpu/iWreB4qE9IDdhG2lIQesfcninPAS8lghhVXcPSXWi5G/y/zIKaCoLQ52131If1aWb9WVO+TpTQ8CFOemi5/5wEPyHwzA1w94ibM8fkz5Bh9GrZp+LoHgZitgj6Q/cccHd5sjh4L/RvyOLWXJTTRs= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1710502753; c=relaxed/simple; bh=q188HzvOUC/SWbrcVrOvRopYEaFyTUWDEJRgbVqCiO4=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=I1HJJ5RUty+aY8gHBKX3MTUgHNz83m5naLib43FivFVnki0hL9IiiSSbVmhlUBudXg2vM777wznyTLbZ8KvU//COKVqbao3pooKyfPfj8+yDLDqOu1c1hNcvToo7IbON2hSWoRsMlQlUBCWSAuRO1FUvQjmA3SXN5Dwzm3/ldHc= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=googlemail.com; spf=pass smtp.mailfrom=googlemail.com; dkim=pass (2048-bit key) header.d=googlemail.com header.i=@googlemail.com header.b=febbbb5S; arc=none smtp.client-ip=209.85.208.44 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=googlemail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=googlemail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=googlemail.com header.i=@googlemail.com header.b="febbbb5S" Received: by mail-ed1-f44.google.com with SMTP id 4fb4d7f45d1cf-563c595f968so2579136a12.0; Fri, 15 Mar 2024 04:39:11 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlemail.com; s=20230601; t=1710502750; x=1711107550; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=cfmF9oVuH/nqtcAZ9ZoTPovZTcMFlC6oTWbI9R5zfGA=; b=febbbb5S6zucEme1c3YDVJghkJzmoxo53V2i8FKe9wvFAw3ovHOIY1VaJ1rXM1FKxF EQ4Xiju5bVy8M11BrOdiy3vUmbspXL2M6zwvc3xBLGvVJqQ6bHvdswXPGvBd9blqHhrL rEmQeU78d9jw0RJtzilfFr8svnEe9YPpBhSLQb8kJC32PBcmRj5Q4TE926YZsWaP4+NB JQZKjPRGnVV+tGM4WvREV8XhWf43E50WOQXFe8ke11kue1PSufxmpEgoANbtstYdNMTV y11Sn17VmZA0dKj7/sidoFrM2A9Laz67lVa+9xOtPd3U7TpuvvcWjf6e1TYU4Bx/sTC2 CwFQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1710502750; x=1711107550; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=cfmF9oVuH/nqtcAZ9ZoTPovZTcMFlC6oTWbI9R5zfGA=; b=iJYHXdQuvK6x3RW7EJnyreV34G/dgUcEJw3F4TVNC49Vtg0LSau6dTNMajsYkrYDpn JVDmFNBq06eShid3Vj3XMCwBvUi3ZOtClTTDGjB7n8/DXDns9Sz7LtQZ/rsPQyasJFLi wL9/tsNrb54gjg1wjuR9gwI3YxU5BLp/Cn4Y2Wgt53Nju+rx2brG75QfIbZQJRLDfCYe SUMWmAVrZ39p9ak3YXmXqOPlyT5awee/omWFsCOW4enwC9pFhktKOPkhCRSd6agKIefb 5LBcXfHORnVvsDdi2EOWs3tB7X5OerpE+g3Y0i9MGxaW/MnDu1XmpZfB2RDMUoQOj96S +VmA== X-Forwarded-Encrypted: i=1; AJvYcCXy8EFAigHF5YWFoPDslQK6rWEpddaq/43rvIOhxfaJk8BteoAMQ1b0aj/7xVshtYckx+KLHxsCLLGng1c9LvEvBnjaKef/NYTi/Iid07WiAPYoGw8HPp9kEHgqe+Tvcc/G X-Gm-Message-State: AOJu0Yx6d9NHFovyx7tYBhYk1Q1ZeXErtVU3hCUbQLFFtECKVjhUBH5T pFHXP5wTRUqHyuQ291n2ImSSfKuipm1ZzqfDObj3QP4I347kdhmwg0VpbfV84qpD6A== X-Google-Smtp-Source: AGHT+IGW1uWxdTJiFXfLpY+Fl3cbOeeZ6/+E5blbanUFwgZizbLKEo3Rs6c248+0TJkAzhcIeBzNLQ== X-Received: by 2002:aa7:cd58:0:b0:568:260b:e502 with SMTP id v24-20020aa7cd58000000b00568260be502mr2091951edw.13.1710502749840; Fri, 15 Mar 2024 04:39:09 -0700 (PDT) Received: from ddev.DebianHome (dynamic-095-119-217-226.95.119.pool.telefonica.de. [95.119.217.226]) by smtp.gmail.com with ESMTPSA id fg3-20020a056402548300b005682f47aea7sm1610024edb.94.2024.03.15.04.39.09 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 15 Mar 2024 04:39:09 -0700 (PDT) From: =?utf-8?q?Christian_G=C3=B6ttsche?= To: linux-security-module@vger.kernel.org Cc: Serge Hallyn , Julia Lawall , Nicolas Palix , linux-kernel@vger.kernel.org, cocci@inria.fr, bpf@vger.kernel.org Subject: [PATCH 10/10] coccinelle: add script for capable_any() Date: Fri, 15 Mar 2024 12:37:31 +0100 Message-ID: <20240315113828.258005-10-cgzones@googlemail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20240315113828.258005-1-cgzones@googlemail.com> References: <20240315113828.258005-1-cgzones@googlemail.com> Precedence: bulk X-Mailing-List: linux-security-module@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Add a script to find and replace chained capable() calls with capable_any(). Also find and replace capable_any() calls where CAP_SYS_ADMIN was passed as first argument. Signed-off-by: Christian Göttsche --- v5: add patch --- MAINTAINERS | 1 + scripts/coccinelle/api/capable_any.cocci | 164 +++++++++++++++++++++++ 2 files changed, 165 insertions(+) create mode 100644 scripts/coccinelle/api/capable_any.cocci diff --git a/MAINTAINERS b/MAINTAINERS index f4d7f7cb7577..32349e4c5f56 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -4731,6 +4731,7 @@ S: Supported F: include/linux/capability.h F: include/uapi/linux/capability.h F: kernel/capability.c +F: scripts/coccinelle/api/capable_any.cocci F: security/commoncap.c CAPELLA MICROSYSTEMS LIGHT SENSOR DRIVER diff --git a/scripts/coccinelle/api/capable_any.cocci b/scripts/coccinelle/api/capable_any.cocci new file mode 100644 index 000000000000..83aedd3bf81d --- /dev/null +++ b/scripts/coccinelle/api/capable_any.cocci @@ -0,0 +1,164 @@ +// SPDX-License-Identifier: GPL-2.0-only +/// Use capable_any rather than chaining capable and order CAP_SYS_ADMIN last +/// +// Confidence: High +// Copyright: (C) 2024 Christian Göttsche. +// URL: https://coccinelle.gitlabpages.inria.fr/website +// Options: --no-includes --include-headers +// Keywords: capable, capable_any, ns_capable, ns_capable_any, sockopt_ns_capable, sockopt_ns_capable_any + +virtual patch +virtual context +virtual org +virtual report + +//---------------------------------------------------------- +// For patch mode +//---------------------------------------------------------- + +@ depends on patch@ +binary operator op; +expression cap1,cap2,E; +expression ns; +@@ + +( +- capable(cap1) || capable(cap2) ++ capable_any(cap1, cap2) +| +- E op capable(cap1) || capable(cap2) ++ E op capable_any(cap1, cap2) +| +- !capable(cap1) && !capable(cap2) ++ !capable_any(cap1, cap2) +| +- E op !capable(cap1) && !capable(cap2) ++ E op !capable_any(cap1, cap2) +| +- ns_capable(ns, cap1) || ns_capable(ns, cap2) ++ ns_capable_any(ns, cap1, cap2) +| +- E op ns_capable(ns, cap1) || ns_capable(ns, cap2) ++ E op ns_capable_any(ns, cap1, cap2) +| +- !ns_capable(ns, cap1) && !ns_capable(ns, cap2) ++ !ns_capable_any(ns, cap1, cap2) +| +- E op !ns_capable(ns, cap1) && !ns_capable(ns, cap2) ++ E op !ns_capable_any(ns, cap1, cap2) +| +- sockopt_ns_capable(ns, cap1) || sockopt_ns_capable(ns, cap2) ++ sockopt_ns_capable_any(ns, cap1, cap2) +| +- E op sockopt_ns_capable(ns, cap1) || sockopt_ns_capable(ns, cap2) ++ E op sockopt_ns_capable_any(ns, cap1, cap2) +| +- !sockopt_ns_capable(ns, cap1) && !sockopt_ns_capable(ns, cap2) ++ !sockopt_ns_capable_any(ns, cap1, cap2) +| +- E op !sockopt_ns_capable(ns, cap1) && !sockopt_ns_capable(ns, cap2) ++ E op !sockopt_ns_capable_any(ns, cap1, cap2) +) + +@ depends on patch@ +identifier func = { capable_any, ns_capable_any, sockopt_ns_capable_any }; +expression cap; +expression ns; +@@ + +( +- func(CAP_SYS_ADMIN, cap) ++ func(cap, CAP_SYS_ADMIN) +| +- func(ns, CAP_SYS_ADMIN, cap) ++ func(ns, cap, CAP_SYS_ADMIN) +) + +//---------------------------------------------------------- +// For context mode +//---------------------------------------------------------- + +@r1 depends on !patch exists@ +binary operator op; +expression cap1,cap2,E; +expression ns; +position p1,p2; +@@ + +( +* capable@p1(cap1) || capable@p2(cap2) +| +* E op capable@p1(cap1) || capable@p2(cap2) +| +* !capable@p1(cap1) && !capable@p2(cap2) +| +* E op !capable@p1(cap1) && !capable@p2(cap2) +| +* ns_capable@p1(ns, cap1) || ns_capable@p2(ns, cap2) +| +* E op ns_capable@p1(ns, cap1) || ns_capable@p2(ns, cap2) +| +* !ns_capable@p1(ns, cap1) && !ns_capable@p2(ns, cap2) +| +* E op !ns_capable@p1(ns, cap1) && !ns_capable@p2(ns, cap2) +| +* sockopt_ns_capable@p1(ns, cap1) || sockopt_ns_capable@p2(ns, cap2) +| +* E op sockopt_ns_capable@p1(ns, cap1) || sockopt_ns_capable@p2(ns, cap2) +| +* !sockopt_ns_capable@p1(ns, cap1) && !sockopt_ns_capable@p2(ns, cap2) +| +* E op !sockopt_ns_capable@p1(ns, cap1) && !sockopt_ns_capable@p2(ns, cap2) +) + +@r2 depends on !patch exists@ +identifier func = { capable_any, ns_capable_any, sockopt_ns_capable_any }; +expression cap; +expression ns; +position p; +@@ + +( +* func@p(CAP_SYS_ADMIN, cap) +| +* func@p(ns, CAP_SYS_ADMIN, cap) +) + +//---------------------------------------------------------- +// For org mode +//---------------------------------------------------------- + +@script:python depends on org@ +p1 << r1.p1; +p2 << r1.p2; +@@ + +cocci.print_main("WARNING opportunity for capable_any",p1) +cocci.print_secs("chained capable",p2) + +@script:python depends on org@ +p << r2.p; +f << r2.func; +@@ + +cocci.print_main("WARNING " + f + " arguments should be reordered",p) + +//---------------------------------------------------------- +// For report mode +//---------------------------------------------------------- + +@script:python depends on report@ +p1 << r1.p1; +p2 << r1.p2; +@@ + +msg = "WARNING opportunity for capable_any (chained capable line %s)" % (p2[0].line) +coccilib.report.print_report(p1[0], msg) + +@script:python depends on report@ +p << r2.p; +f << r2.func; +@@ + +msg = "WARNING %s arguments should be reordered" % (f) +coccilib.report.print_report(p[0], msg)