From patchwork Thu May 11 14:25:24 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Christian_G=C3=B6ttsche?= X-Patchwork-Id: 92649 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a05:6358:3046:b0:115:7a1d:dabb with SMTP id p6csp4478812rwl; Thu, 11 May 2023 07:28:22 -0700 (PDT) X-Google-Smtp-Source: ACHHUZ4kW2TDbCevbxy/wcp9XTG/BpoaDloJVv6T8+OrMUsRCSRDYc92E0gNVw9tw+GasssJf/0d X-Received: by 2002:a17:902:ea0f:b0:1a6:846f:90cb with SMTP id s15-20020a170902ea0f00b001a6846f90cbmr34238168plg.11.1683815301794; Thu, 11 May 2023 07:28:21 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1683815301; cv=none; d=google.com; s=arc-20160816; b=yk5e5rHIjTlxWLBcDC3yfVegPqqwiJ/p22jcNwKJjmKsdnde3A1nfyCbjLIBXQ4+rS /iuUR0KtrNa5ZcIq7TPBh3oae+SOX2QmCSlTEYCdrW6PQbLbzVK4nZ5nkCfp3rKzB8Yr tPDGJuE0nCMk5YUY1APHKc23Q+TWt0Ico5LD3tkWIzaEKpOkVQz3EsHZVUSiW2ABhJzt vorYpJsxDnxps5KsmSKr4SvtIFE3VhlAiV9mu7EoG/QCmsbJOy/sBvsxrwBewWdw6w8v GPyP4yRZf0tQGkHGGEw+d4rQgjOQPQkNrYL0p9sCjlMOCImY4C6y6SVr7g90gmrqV770 nxug== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :message-id:date:subject:cc:to:from:dkim-signature; bh=FfHvJaE373FwPkBo+MbvKKH9vrJm6j2m01pppMLR2Fs=; b=ghvaoPeV0ZHwMo02ddShHH0BqjpHpzxrb4dGjgaKK5JM9orTCSsHGoVTNn80aVr8Yf ANVPvt15G5jy7ejn9bLtCpTUmHV03gzPI3ejHPrQ+0QH/7OCBDtJ5LaYBqL83yUr7NUY fK3BZ+OhNMy8x5eqp0vmLoJGotLytpMHNIUokPEOiRaymIJcQMly1kBulOil0Bd1Z4Hy 0Lgki1g7mGZWQfjMpCTTTb1MOHYPTiGly6dAVeUMchjNGfF6dKywTRqrAwrs2bKY6J8D XcJqLs8+Q2PwGMR0d68hZAUHUqQuroGKZbSN3SYugq8UBxh+TUZXXfvVwWyS+crvpX+7 J7yQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@googlemail.com header.s=20221208 header.b=n9Y7Em7S; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=googlemail.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id k7-20020a635607000000b0052cb36e0bfdsi6640583pgb.429.2023.05.11.07.28.07; Thu, 11 May 2023 07:28:21 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@googlemail.com header.s=20221208 header.b=n9Y7Em7S; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=googlemail.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238415AbjEKO06 (ORCPT + 99 others); Thu, 11 May 2023 10:26:58 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46574 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S238459AbjEKO0n (ORCPT ); Thu, 11 May 2023 10:26:43 -0400 Received: from mail-ed1-x52e.google.com (mail-ed1-x52e.google.com [IPv6:2a00:1450:4864:20::52e]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 8D8CF11600; Thu, 11 May 2023 07:26:32 -0700 (PDT) Received: by mail-ed1-x52e.google.com with SMTP id 4fb4d7f45d1cf-50b383222f7so12957097a12.3; Thu, 11 May 2023 07:26:32 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlemail.com; s=20221208; t=1683815191; x=1686407191; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=FfHvJaE373FwPkBo+MbvKKH9vrJm6j2m01pppMLR2Fs=; b=n9Y7Em7SkB9orYrAbcCUvQXxkKi727MiQdFajf4HlIYSHX2PG9dMO34uyKqJrZ5cit i4+wO58Ror05WSxbokgiqseHvrBbqqie2cxX7KTFU071x1BQhSh+2dEnOHgunVWzaPOO IQvNEKYfRGf05i3DNDX88Njr55+onoL6F2nnpPjanz16zRSjfQdZj6yyRVqiQrzImILd Z/OWXk2gkmISUByuBUlZnuNGfbmO4N9WHTkesGj3dEgnTkcJmbXkIqjAHdpjSzgn8YLm wTv3jqTgBm+oKURueLWtI94wjqxO2TmC1YXk9er+4EojpU1xst3Cr6Jg+XEtf2oScBgM odyQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1683815191; x=1686407191; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=FfHvJaE373FwPkBo+MbvKKH9vrJm6j2m01pppMLR2Fs=; b=l9eaLf5Zu+DvpscGeB6yQrBViffhtwaRVI2YX+Izny+pezvhT7zBj7pmBFtBYB70Wv ylUFhwVfCbdk9rX7V04m/N8747AoAPf56lfzUXxh7YHY4pCZHz1crkyu0G00CxbjlFDJ emgTYKddD4GXNssnFQbvfxw/OJWi5kLEjK6PGVdhtMdL403gvIWPgtJKZrFHmWRJx/j8 k8F3NoCB7lraMg6c3mT3+LXw3Sm6LS9Leeu1Pyt2nBsOtLLAYZiUgYWpFUrp7Bs3OLZJ Ml1PlDcLplxvu8hq3lNEzdtcYa74mpebOf3G+Pf/HyHDCJDqQeWiNSfR961IPz/V5+tW +hQw== X-Gm-Message-State: AC+VfDwOa1LydRGbHSNmP9YW/CWzf+wGyU4ycosvmVHI5oGQk6vEvnS9 JnN2bmQgW63dq797dKEos36qjCx6TMY9og== X-Received: by 2002:a17:907:a46:b0:94f:2b80:f3b4 with SMTP id be6-20020a1709070a4600b0094f2b80f3b4mr17315061ejc.69.1683815190662; Thu, 11 May 2023 07:26:30 -0700 (PDT) Received: from debianHome.localdomain (dynamic-077-008-180-228.77.8.pool.telefonica.de. [77.8.180.228]) by smtp.gmail.com with ESMTPSA id hf15-20020a1709072c4f00b0094f58a85bc5sm4056647ejc.180.2023.05.11.07.26.28 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 11 May 2023 07:26:29 -0700 (PDT) From: =?utf-8?q?Christian_G=C3=B6ttsche?= To: selinux@vger.kernel.org Cc: Paul Moore , John Johansen , James Morris , "Serge E. Hallyn" , Stephen Smalley , Eric Paris , Christian Brauner , Casey Schaufler , Dave Chinner , Nathan Lynch , Al Viro , Roberto Sassu , Micah Morton , Frederick Lawler , =?utf-8?q?G=C3=BCnther_Noack?= , linux-kernel@vger.kernel.org, apparmor@lists.ubuntu.com, linux-security-module@vger.kernel.org, bpf@vger.kernel.org Subject: [PATCH v4 1/9] capability: introduce new capable flag NODENYAUDIT Date: Thu, 11 May 2023 16:25:24 +0200 Message-Id: <20230511142535.732324-1-cgzones@googlemail.com> X-Mailer: git-send-email 2.40.1 MIME-Version: 1.0 X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FREEMAIL_FROM, RCVD_IN_DNSWL_NONE,SPF_HELO_NONE,SPF_PASS,T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1765608313788879084?= X-GMAIL-MSGID: =?utf-8?q?1765608313788879084?= Introduce a new capable flag, CAP_OPT_NODENYAUDIT, to not generate an audit event if the requested capability is not granted. This will be used in a new capable_any() functionality to reduce the number of necessary capable calls. Handle the flag accordingly in AppArmor and SELinux. Suggested-by: Paul Moore Signed-off-by: Christian Göttsche Reviewed-by: Serge Hallyn --- include/linux/security.h | 2 ++ security/apparmor/capability.c | 8 +++++--- security/selinux/hooks.c | 14 ++++++++------ 3 files changed, 15 insertions(+), 9 deletions(-) diff --git a/include/linux/security.h b/include/linux/security.h index e2734e9e44d5..629c775ec297 100644 --- a/include/linux/security.h +++ b/include/linux/security.h @@ -67,6 +67,8 @@ struct watch_notification; #define CAP_OPT_NOAUDIT BIT(1) /* If capable is being called by a setid function */ #define CAP_OPT_INSETID BIT(2) +/* If capable should audit the security request for authorized requests only */ +#define CAP_OPT_NODENYAUDIT BIT(3) /* LSM Agnostic defines for security_sb_set_mnt_opts() flags */ #define SECURITY_LSM_NATIVE_LABELS 1 diff --git a/security/apparmor/capability.c b/security/apparmor/capability.c index 326a51838ef2..98120dd62ca7 100644 --- a/security/apparmor/capability.c +++ b/security/apparmor/capability.c @@ -108,7 +108,8 @@ static int audit_caps(struct common_audit_data *sa, struct aa_profile *profile, * profile_capable - test if profile allows use of capability @cap * @profile: profile being enforced (NOT NULL, NOT unconfined) * @cap: capability to test if allowed - * @opts: CAP_OPT_NOAUDIT bit determines whether audit record is generated + * @opts: CAP_OPT_NOAUDIT/CAP_OPT_NODENYAUDIT bit determines whether audit + * record is generated * @sa: audit data (MAY BE NULL indicating no auditing) * * Returns: 0 if allowed else -EPERM @@ -126,7 +127,7 @@ static int profile_capable(struct aa_profile *profile, int cap, else error = -EPERM; - if (opts & CAP_OPT_NOAUDIT) { + if ((opts & CAP_OPT_NOAUDIT) || ((opts & CAP_OPT_NODENYAUDIT) && error)) { if (!COMPLAIN_MODE(profile)) return error; /* audit the cap request in complain mode but note that it @@ -142,7 +143,8 @@ static int profile_capable(struct aa_profile *profile, int cap, * aa_capable - test permission to use capability * @label: label being tested for capability (NOT NULL) * @cap: capability to be tested - * @opts: CAP_OPT_NOAUDIT bit determines whether audit record is generated + * @opts: CAP_OPT_NOAUDIT/CAP_OPT_NODENYAUDIT bit determines whether audit + * record is generated * * Look up capability in profile capability set. * diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index 79b4890e9936..0730edf2f5f1 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -1571,7 +1571,7 @@ static int cred_has_capability(const struct cred *cred, u16 sclass; u32 sid = cred_sid(cred); u32 av = CAP_TO_MASK(cap); - int rc; + int rc, rc2; ad.type = LSM_AUDIT_DATA_CAP; ad.u.cap = cap; @@ -1590,11 +1590,13 @@ static int cred_has_capability(const struct cred *cred, } rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd); - if (!(opts & CAP_OPT_NOAUDIT)) { - int rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad); - if (rc2) - return rc2; - } + if ((opts & CAP_OPT_NOAUDIT) || ((opts & CAP_OPT_NODENYAUDIT) && rc)) + return rc; + + rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad); + if (rc2) + return rc2; + return rc; } From patchwork Thu May 11 14:25:25 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Christian_G=C3=B6ttsche?= X-Patchwork-Id: 92656 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a05:6358:3046:b0:115:7a1d:dabb with SMTP id p6csp4484803rwl; Thu, 11 May 2023 07:36:33 -0700 (PDT) X-Google-Smtp-Source: ACHHUZ5cVsngHIOhWprAMPQ5/N3TdaF4P6RTJ1DjtEKYSyVcHoWW2uX1kJyqDABq0TNGXfqMW1UW X-Received: by 2002:a05:6a00:338c:b0:647:a3e5:f401 with SMTP id cm12-20020a056a00338c00b00647a3e5f401mr8804137pfb.5.1683815792879; Thu, 11 May 2023 07:36:32 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1683815792; cv=none; d=google.com; s=arc-20160816; b=OI+llqGXlvl3VQtue+MQZYWDir2F/bVGR36M0lfHT0kiLxhNCYYm8FZY47/z1gLh2Q JMlkeiwfYTOssSN3+qJfjDaXOkTuTeecvNxiwvjf2bFMncYgrss4RRJ06sbymn9vmE0V 0Zl6klowJOC5BaCbB7XuWukNqRg8Y5slNWOYJOD3m/TPMcP+m8Q201IxGjnrij3cq95H 0h6g6MQUuMTp09rqDzFAH2C6yYXgDDG0y78l9egGlAHXg4fZwnTRt1j7yuH0FHULwMhy 2XobkLjRkMRtbBD0DbdmhTlegvw+yrK5WkXRjPqxrog8OW7pqansheDbWAAU7cYz3fOC lhzw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=BpxDj8P/CkXIcvSdZuhR1VFy2f2KQ0RPAwIQ63hDnKo=; b=JnpH73MTnEnLHGgaaREHuj1CRGaF4D1HhFPGMNRL1uYkN3QOo0LV9PU8dFtSIkMMSO 6LRFG6CaXWEMZyG05BvPIq+g6L7/eg9SeKaiAyRzGZ2L27ULxkkkY10LYr0z1joGdnqI XvqCNUAhiE/cIf3aPdvOkREy0gy+weohFji1jWH+cqwxjudFJ5M1XceT0uJoaKNm3Axf hV057a3OLN1/gLDGMs1S+CHssrLSEpLtEqLG3bPpMMgOkK+gRFzSBwgdV/h3N4w5L6q/ OOLaR5cQ6OYZ6o+DNOgKEMDeFkxVKHcj0eSxkFjtH4VDCD3iXvJdVbpwBKC9tFdME2Sd kbSA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@googlemail.com header.s=20221208 header.b=RrYgmHxo; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=googlemail.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id w7-20020aa79547000000b0064490c20e80si7758092pfq.59.2023.05.11.07.36.17; Thu, 11 May 2023 07:36:32 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@googlemail.com header.s=20221208 header.b=RrYgmHxo; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=googlemail.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238150AbjEKO1C (ORCPT + 99 others); Thu, 11 May 2023 10:27:02 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43618 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S238268AbjEKO0n (ORCPT ); Thu, 11 May 2023 10:26:43 -0400 Received: from mail-ej1-x635.google.com (mail-ej1-x635.google.com [IPv6:2a00:1450:4864:20::635]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 9115411619; Thu, 11 May 2023 07:26:33 -0700 (PDT) Received: by mail-ej1-x635.google.com with SMTP id a640c23a62f3a-965d2749e2eso1257311366b.1; Thu, 11 May 2023 07:26:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlemail.com; s=20221208; t=1683815192; x=1686407192; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=BpxDj8P/CkXIcvSdZuhR1VFy2f2KQ0RPAwIQ63hDnKo=; b=RrYgmHxo5etwhT/+56sn3wE+KundDALBLWMxxqFJp+4r6+BTti+1ZxLbgDew+kmFlL pn/3qFjmvgSICpbTr+Fq1fxorBJQy5Np9CWnI9jBGMxm80Z+heymVUqQABFxloaznsFn eVeM+4yc6W6z96vt/QyUokeQEonko22mVp6rlKchpnHE6IF1RHtDxtIvnzHoNpHUt5sm r2BZGkurhW1sCfWyZtAoU4KgJYjlG5dX7T3hTYtRq56B5tyUO+hSWbKuHCAM+Nea92qA m5pCPubDAsuXkvWrB/3/cGPoz1p5DjAsNtajIyUEuXkZFoBouCCAcLqomM67QSs++9ze bJnQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1683815192; x=1686407192; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=BpxDj8P/CkXIcvSdZuhR1VFy2f2KQ0RPAwIQ63hDnKo=; b=OsQz+6feCRphc+/Z4i76pww8Mw/0VdFOvI8jtNAd6Bs3fdWvqLxztOFD0FvsLuLPB4 C5N5hodpD6+4VX6NyaLN0JSl15SyD03hbOcXLAnTXnJQCWfAZcjyjpk2OWBZnpJBfcqZ rxRWD95GqKg7eIW9HWGpx2KvTmZFsKbSUyaveNynNSZyEAZP5iW/25IKusSWyIv4qPpn Pdy2eGx+tY1tidwfx5eAnLC7X9iwMgO0qNWxNMx4TCJKPFfy99ZOKGbt8iVCqcPqn4Hy R+zYSJyNd8jzWaiXw5PiR8HmO3R1saF1AhAf0y7XicMjQ3PrLDNBuj3uF3bpIehejjDC UdJg== X-Gm-Message-State: AC+VfDzUQyzs8txj5er/7yLVwQlYnuF9pP0FFub2OACYELDwKm7PZE2h nNczhtqTMOUYRWboE+fq+xo+uUQuL8q/Vw== X-Received: by 2002:a17:906:eec9:b0:94f:73db:b390 with SMTP id wu9-20020a170906eec900b0094f73dbb390mr16686831ejb.65.1683815191760; Thu, 11 May 2023 07:26:31 -0700 (PDT) Received: from debianHome.localdomain (dynamic-077-008-180-228.77.8.pool.telefonica.de. [77.8.180.228]) by smtp.gmail.com with ESMTPSA id hf15-20020a1709072c4f00b0094f58a85bc5sm4056647ejc.180.2023.05.11.07.26.31 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 11 May 2023 07:26:31 -0700 (PDT) From: =?utf-8?q?Christian_G=C3=B6ttsche?= To: selinux@vger.kernel.org Cc: Serge Hallyn , linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org, bpf@vger.kernel.org Subject: [PATCH v4 2/9] capability: add any wrapper to test for multiple caps with exactly one audit message Date: Thu, 11 May 2023 16:25:25 +0200 Message-Id: <20230511142535.732324-2-cgzones@googlemail.com> X-Mailer: git-send-email 2.40.1 In-Reply-To: <20230511142535.732324-1-cgzones@googlemail.com> References: <20230511142535.732324-1-cgzones@googlemail.com> MIME-Version: 1.0 X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FREEMAIL_FROM, RCVD_IN_DNSWL_NONE,SPF_HELO_NONE,SPF_PASS,T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1765608829000809325?= X-GMAIL-MSGID: =?utf-8?q?1765608829000809325?= Add the interfaces `capable_any()` and `ns_capable_any()` as an alternative to multiple `capable()`/`ns_capable()` calls, like `capable_any(CAP_SYS_NICE, CAP_SYS_ADMIN)` instead of `capable(CAP_SYS_NICE) || capable(CAP_SYS_ADMIN)`. `capable_any()`/`ns_capable_any()` will in particular generate exactly one audit message, either for the left most capability in effect or, if the task has none, the first one. This is especially helpful with regard to SELinux, where each audit message about a not allowed capability request will create a denial message. Using this new wrapper with the least invasive capability as left most argument (e.g. CAP_SYS_NICE before CAP_SYS_ADMIN) enables policy writers to only grant the least invasive one for the particular subject instead of both. Signed-off-by: Christian Göttsche --- v4: Use CAP_OPT_NODENYAUDIT via added ns_capable_nodenyaudit() v3: - rename to capable_any() - fix typo in function documentation - add ns_capable_any() v2: avoid varargs and fix to two capabilities; capable_or3() can be added later if needed --- include/linux/capability.h | 10 ++++++ kernel/capability.c | 70 ++++++++++++++++++++++++++++++++++++++ 2 files changed, 80 insertions(+) diff --git a/include/linux/capability.h b/include/linux/capability.h index 0c356a517991..eeb958440656 100644 --- a/include/linux/capability.h +++ b/include/linux/capability.h @@ -146,7 +146,9 @@ extern bool has_capability_noaudit(struct task_struct *t, int cap); extern bool has_ns_capability_noaudit(struct task_struct *t, struct user_namespace *ns, int cap); extern bool capable(int cap); +extern bool capable_any(int cap1, int cap2); extern bool ns_capable(struct user_namespace *ns, int cap); +extern bool ns_capable_any(struct user_namespace *ns, int cap1, int cap2); extern bool ns_capable_noaudit(struct user_namespace *ns, int cap); extern bool ns_capable_setid(struct user_namespace *ns, int cap); #else @@ -172,10 +174,18 @@ static inline bool capable(int cap) { return true; } +static inline bool capable_any(int cap1, int cap2) +{ + return true; +} static inline bool ns_capable(struct user_namespace *ns, int cap) { return true; } +static inline bool ns_capable_any(struct user_namespace *ns, int cap1, int cap2) +{ + return true; +} static inline bool ns_capable_noaudit(struct user_namespace *ns, int cap) { return true; diff --git a/kernel/capability.c b/kernel/capability.c index 3e058f41df32..d50544063920 100644 --- a/kernel/capability.c +++ b/kernel/capability.c @@ -402,6 +402,23 @@ bool ns_capable_noaudit(struct user_namespace *ns, int cap) } EXPORT_SYMBOL(ns_capable_noaudit); +/** + * ns_capable_nodenyaudit - Determine if the current task has a superior capability + * (unaudited when not authorized) in effect + * @ns: The usernamespace we want the capability in + * @cap: The capability to be tested for + * + * Return true if the current task has the given superior capability currently + * available for use, false if not. + * + * This sets PF_SUPERPRIV on the task if the capability is available on the + * assumption that it's about to be used. + */ +static bool ns_capable_nodenyaudit(struct user_namespace *ns, int cap) +{ + return ns_capable_common(ns, cap, CAP_OPT_NODENYAUDIT); +} + /** * ns_capable_setid - Determine if the current task has a superior capability * in effect, while signalling that this check is being done from within a @@ -421,6 +438,59 @@ bool ns_capable_setid(struct user_namespace *ns, int cap) } EXPORT_SYMBOL(ns_capable_setid); +/** + * ns_capable_any - Determine if the current task has one of two superior capabilities in effect + * @ns: The usernamespace we want the capability in + * @cap1: The capabilities to be tested for first + * @cap2: The capabilities to be tested for secondly + * + * Return true if the current task has at least one of the two given superior + * capabilities currently available for use, false if not. + * + * In contrast to or'ing capable() this call will create exactly one audit + * message, either for @cap1, if it is granted or both are not permitted, + * or @cap2, if it is granted while the other one is not. + * + * The capabilities should be ordered from least to most invasive, i.e. CAP_SYS_ADMIN last. + * + * This sets PF_SUPERPRIV on the task if the capability is available on the + * assumption that it's about to be used. + */ +bool ns_capable_any(struct user_namespace *ns, int cap1, int cap2) +{ + if (ns_capable_nodenyaudit(ns, cap1)) + return true; + + if (ns_capable_nodenyaudit(ns, cap2)) + return true; + + return ns_capable(ns, cap1); +} +EXPORT_SYMBOL(ns_capable_any); + +/** + * capable_any - Determine if the current task has one of two superior capabilities in effect + * @cap1: The capabilities to be tested for first + * @cap2: The capabilities to be tested for secondly + * + * Return true if the current task has at least one of the two given superior + * capabilities currently available for use, false if not. + * + * In contrast to or'ing capable() this call will create exactly one audit + * message, either for @cap1, if it is granted or both are not permitted, + * or @cap2, if it is granted while the other one is not. + * + * The capabilities should be ordered from least to most invasive, i.e. CAP_SYS_ADMIN last. + * + * This sets PF_SUPERPRIV on the task if the capability is available on the + * assumption that it's about to be used. + */ +bool capable_any(int cap1, int cap2) +{ + return ns_capable_any(&init_user_ns, cap1, cap2); +} +EXPORT_SYMBOL(capable_any); + /** * capable - Determine if the current task has a superior capability in effect * @cap: The capability to be tested for From patchwork Thu May 11 14:25:26 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Christian_G=C3=B6ttsche?= X-Patchwork-Id: 92650 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a05:6358:3046:b0:115:7a1d:dabb with SMTP id p6csp4478972rwl; Thu, 11 May 2023 07:28:37 -0700 (PDT) X-Google-Smtp-Source: ACHHUZ6yoBCzkjoMpAPYQ0/+dqct+AJxT7WWvmdPrfu7DertvkWZYt+G2bkrKpo2DbRsKEvxYpZT X-Received: by 2002:a05:6a20:7287:b0:101:3eb9:2a75 with SMTP id o7-20020a056a20728700b001013eb92a75mr13561742pzk.16.1683815316693; Thu, 11 May 2023 07:28:36 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1683815316; cv=none; d=google.com; s=arc-20160816; b=AWp/iHWH9v2b2+fdUF+gblBWeuRqIWS+ImYut5Zqlwx02okpUc9CWa+JHlU05T90ed nPDgxPUWm9qKlZnuhy3G7S3nbwP8I9yn54kA0ZI9vBl+UVFfARRPkqR+mBd6CdBNxecL BMFFVa5iB4QnaovgsIzvrZpPUVy1CEUvdaXwytwHCdCvb8j7WXCLtA+W+bpzYItrm0C/ 61n/vVgztGd7TGP39U/5wWUPiH+Homx7KxNWBShln33K7M28EQ09VPvhMzf3C51DPjGV E9bYpMdbIlwlSB+Q59fXL2nconu4RGDeRmUradSO2fhYR5aBFAy/+/XqbawnsAxK2c8V hFZw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=VtnLQFC3gXKN18su7z8CdgFlcJ7YFC5IMpgUUhV6x+s=; b=dBWRm6sTNRUjRx3QSE3jnKkr//sT5MOUVw+kVdgDrKudWWTJWUgg0ajlqeVw0qPS91 jMjD7rdS/yESTcQS1dA3xhwRY4ErSqOo2Y4ZRaIsRI5SaBxMeD8UXxxunNwqgJGFfxe6 lBP2fEFXM2CYTOK4JD07OCVxzJXgMxVHCeVw9T2Kl94DC7z8AZj2jN3tIiX34vaODWXg ebSKxU8qwpt697LarXD4HtetO3D9FJUIUNG9GF2yXBYGUpvIeXHfIN32iQ4R4GaAiYyo 9m64/Qm2CIAZaP2gAjomKMfLDWwLL6lvU3JnRMbsJ8CSuksuG4tfm2QmQtDXOWswHHj7 q8EQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@googlemail.com header.s=20221208 header.b=odR9I3Zd; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=googlemail.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id f26-20020a63755a000000b0051b48085aaasi6839576pgn.858.2023.05.11.07.28.23; Thu, 11 May 2023 07:28:36 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@googlemail.com header.s=20221208 header.b=odR9I3Zd; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=googlemail.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238472AbjEKO1G (ORCPT + 99 others); Thu, 11 May 2023 10:27:06 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43626 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S238469AbjEKO0o (ORCPT ); Thu, 11 May 2023 10:26:44 -0400 Received: from mail-ej1-x633.google.com (mail-ej1-x633.google.com [IPv6:2a00:1450:4864:20::633]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 6897440E3; Thu, 11 May 2023 07:26:34 -0700 (PDT) Received: by mail-ej1-x633.google.com with SMTP id a640c23a62f3a-9659c5b14d8so1430115666b.3; Thu, 11 May 2023 07:26:34 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlemail.com; s=20221208; t=1683815193; x=1686407193; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=VtnLQFC3gXKN18su7z8CdgFlcJ7YFC5IMpgUUhV6x+s=; b=odR9I3ZdlQySSrmNFXoB6k5sPZrNpWKh4/Y3cgy7V+hTnDwQ2U7nRTFcMk6eIRXPWH zvDAoYwk4T9Jlf9igEiUD77UETuhyS2fUf1IMAptXXC4RXCQxUk8dKu625kbiDy7vzFS x2SC3oRk34/JZ/OH/mU7wwmykBJsq7ei2kebFWo6qyZgMVgEkyqeXdttwAT3mbQ1Bkpo lATUda+9JDgXZG0+sDbBtsdOtBfilMry3M+V3HTBRiogJ+HGNg5/7T+shxnESaQZECHI HFDdZJbg6D2Si66ia4hS+LOe+3FzusmXTEemEyzvefQAbbXXOdyOr2AX4gpJzUgUlpL3 XETA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1683815193; x=1686407193; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=VtnLQFC3gXKN18su7z8CdgFlcJ7YFC5IMpgUUhV6x+s=; b=iKxiV1R6b+IH5ZgI8rpPt34PnMBqvr4MKhFwUS16HrXanvwadAu3YZdzGt9pZGhsJd 65jbMW+xaDf04jrMcmiBdhbQC4oaqvmT7DWIORhGzklarHB3aDmW4B44an/+II2905W3 XrslIPxVSfwJZ1Dg5HWwHBVcQ3sCSjY09wszHcz13FD2MrBev/P+UMmcsq1soBy2BAko y/vbJPWeJTEaYgrXKGqaGKd/PBSUvkszQwXgWHkLQQe9cT3ia8d7xV4uarB/Q+guRwec gcjfi1ExcZQrMbrid43PvMirOjBBy7BCgPCZ/trSMqpxCDMViQGgGN+1l6PwwIEjvDaI Oykg== X-Gm-Message-State: AC+VfDwnGPMXzsBp3+Of4Cef9jJ8rGdbHeWrx2x6XBaSF3fLGjthdPbv BbACpt5Ngb5n4mqfevOZOELACpolLjiuSg== X-Received: by 2002:a17:906:4fd1:b0:94f:21f3:b5f8 with SMTP id i17-20020a1709064fd100b0094f21f3b5f8mr19432094ejw.21.1683815192723; Thu, 11 May 2023 07:26:32 -0700 (PDT) Received: from debianHome.localdomain (dynamic-077-008-180-228.77.8.pool.telefonica.de. [77.8.180.228]) by smtp.gmail.com with ESMTPSA id hf15-20020a1709072c4f00b0094f58a85bc5sm4056647ejc.180.2023.05.11.07.26.32 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 11 May 2023 07:26:32 -0700 (PDT) From: =?utf-8?q?Christian_G=C3=B6ttsche?= To: selinux@vger.kernel.org Cc: Serge Hallyn , linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org, bpf@vger.kernel.org Subject: [PATCH v4 3/9] capability: use new capable_any functionality Date: Thu, 11 May 2023 16:25:26 +0200 Message-Id: <20230511142535.732324-3-cgzones@googlemail.com> X-Mailer: git-send-email 2.40.1 In-Reply-To: <20230511142535.732324-1-cgzones@googlemail.com> References: <20230511142535.732324-1-cgzones@googlemail.com> MIME-Version: 1.0 X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FREEMAIL_FROM, RCVD_IN_DNSWL_NONE,SPF_HELO_NONE,SPF_PASS,T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1765608329371369023?= X-GMAIL-MSGID: =?utf-8?q?1765608329371369023?= Use the new added capable_any function in appropriate cases, where a task is required to have any of two capabilities. Signed-off-by: Christian Göttsche Acked-by: Andrii Nakryiko --- v3: - rename to capable_any() - simplify checkpoint_restore_ns_capable() --- include/linux/capability.h | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/include/linux/capability.h b/include/linux/capability.h index eeb958440656..4db0ffb47271 100644 --- a/include/linux/capability.h +++ b/include/linux/capability.h @@ -204,18 +204,17 @@ extern bool file_ns_capable(const struct file *file, struct user_namespace *ns, extern bool ptracer_capable(struct task_struct *tsk, struct user_namespace *ns); static inline bool perfmon_capable(void) { - return capable(CAP_PERFMON) || capable(CAP_SYS_ADMIN); + return capable_any(CAP_PERFMON, CAP_SYS_ADMIN); } static inline bool bpf_capable(void) { - return capable(CAP_BPF) || capable(CAP_SYS_ADMIN); + return capable_any(CAP_BPF, CAP_SYS_ADMIN); } static inline bool checkpoint_restore_ns_capable(struct user_namespace *ns) { - return ns_capable(ns, CAP_CHECKPOINT_RESTORE) || - ns_capable(ns, CAP_SYS_ADMIN); + return ns_capable_any(ns, CAP_CHECKPOINT_RESTORE, CAP_SYS_ADMIN); } /* audit system wants to get cap info from files as well */ From patchwork Thu May 11 14:25:27 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Christian_G=C3=B6ttsche?= X-Patchwork-Id: 92652 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a05:6358:3046:b0:115:7a1d:dabb with SMTP id p6csp4479513rwl; Thu, 11 May 2023 07:29:26 -0700 (PDT) X-Google-Smtp-Source: ACHHUZ4VqHt8CTIdj4SDWptNBDUmN4jQi3MJ7Jz4gu15quI9ussMIdAfen7ZQd1EynsJqa//DeON X-Received: by 2002:a17:902:f804:b0:1a6:d9a6:a9b4 with SMTP id ix4-20020a170902f80400b001a6d9a6a9b4mr22305924plb.3.1683815366550; Thu, 11 May 2023 07:29:26 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1683815366; cv=none; d=google.com; s=arc-20160816; b=rKTUeL30HmRclKtsSb4nozSstVBmNNeQqAMqyYxsLRQW+9UCtbWmL971HKVYoobdXb Qcrnl3eopyHNTYJPxrpJ2DnhVZAmttO3+dktuig8vLdi6dtAEQgU/n9oxbzZJ/YZXD+t PkQ8RDDXoKsVpU8caY8tB9eOtwzb5qiv/Z5WGT0YKuBY9dJh0DS1fsYXl0O6McW9S3GH 86QmRC19/wCCtlJaZ9tL6FF7bAPQ93kgidBEiEmw3Mj0e2YCl4jTPdKYLUpxXE/tCs9o wl4xqAyx76X6cK0/j48XVZ6irf7UwghocguGXzSVoGpqJL+qwbKXUMLQJyC1AtVTzhoT BRmQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=4MLvCJECEpiR/gI61O4GG27R/3uA2bLpDgI5SluFLTA=; b=J2dVHBjXcvtOkOiSUoV9gBqkEWsaH8ssFyQ5g0qgYUhuR0Q4zLW1kcQBLH9L0rsSoE /C2D8eRk1/QLOh01fe2Y0Ah5XfdkXO/9s5c7OKHaDKWZsy4cr9J5xp9XacFlxtFOgpBq GRqjFQSvI+tJjCIT8eN/LRjvxt9COaQ8/b2y+rJfXPwza4xBDm3Z+DK6Ry2YvxntDGyu W4Ogy406v1YBCnwFUW+4h9STG/Lpbk8/8cizaobtZiTWDzrGbpsHY7DReqsxe4ihfyCN Wh8fahHwmWFs7RUtXw9UHLutEUUWLs9DUGr+InxI9VtgbqQpFEmM+40xYU93rKKcs7oU G4Gg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@googlemail.com header.s=20221208 header.b=N68pkqzb; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=googlemail.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id e6-20020a17090301c600b001a1faee77fesi7431326plh.302.2023.05.11.07.29.00; Thu, 11 May 2023 07:29:26 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@googlemail.com header.s=20221208 header.b=N68pkqzb; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=googlemail.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S237987AbjEKO1K (ORCPT + 99 others); Thu, 11 May 2023 10:27:10 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46098 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S238045AbjEKO0r (ORCPT ); Thu, 11 May 2023 10:26:47 -0400 Received: from mail-ed1-x52e.google.com (mail-ed1-x52e.google.com [IPv6:2a00:1450:4864:20::52e]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 8E4AC1161A; Thu, 11 May 2023 07:26:35 -0700 (PDT) Received: by mail-ed1-x52e.google.com with SMTP id 4fb4d7f45d1cf-50bc1612940so15770603a12.2; Thu, 11 May 2023 07:26:35 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlemail.com; s=20221208; t=1683815194; x=1686407194; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=4MLvCJECEpiR/gI61O4GG27R/3uA2bLpDgI5SluFLTA=; b=N68pkqzbvbgbZoltAtubUv7rw9JDXyqdkHGdeKmUKjGpn+E5r4zpUDvVnJnAQ8q/TY nswT/PA0t6FiilhbAjs2ZA920mxwXyD7SPZTe7HZNbzTny4MzUzAmNvhHHV66wy8snLx 133de9nuoDoyUqThzedi9BsiMhYhtTdzwgVSciKF5qTuT6oJJsuGF27/VMHe0X56VIIk TwicLhuN0EsOIppLFg+9pJM4liuIKAxwv8n5eVI+mkQNQ2mlq7LvRyBDbf8JRgmqTfO7 lcYKKtolCRyYdFmOIAklkRShS3Ku0tT6icHA08d77cjRjtZaOJjtu2NwGCVMoJJKg9E7 ZhHQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1683815194; x=1686407194; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=4MLvCJECEpiR/gI61O4GG27R/3uA2bLpDgI5SluFLTA=; b=bQeLQbs/hGeQuIf7/9PVgM2IAje2zH8TKSITp0UdE3zE2DwvMRneblejwZCsnzu28w MHBhYxbaIcwl2Lgs88dHu9i62qmVlYznHhEi3Wf+02h13ragHeNq8zl0Z4weEpyzpLn5 5kg+kOpv64Gh1srARmIXiQKmrfcZksGpgnHxuaPsOMhx4bSRmilFx320OcacfrTWxST4 ap8IZ80kxHl6Wr0XmZXd02p6Hd5Y1niYMj/XSu/gyxJx9NjRUqI4d3BXYUzi1QGd31fa f8eXJuJUamhquCnPwmHxvoNpTCFfBGwtw/Xd1XQwhvQih97HwUJTbtrbIqT91ssWJhwK bn+A== X-Gm-Message-State: AC+VfDyGMDGgV5k9ee9OajuoUKh/xQTtC3PNDLcfuGr3pgx5N/VTuGkO tYuaJDnDg4GMjEHFcnYtw3d9ZY2VqnXmhw== X-Received: by 2002:a17:907:868b:b0:961:57fb:10c1 with SMTP id qa11-20020a170907868b00b0096157fb10c1mr19859592ejc.63.1683815193736; Thu, 11 May 2023 07:26:33 -0700 (PDT) Received: from debianHome.localdomain (dynamic-077-008-180-228.77.8.pool.telefonica.de. [77.8.180.228]) by smtp.gmail.com with ESMTPSA id hf15-20020a1709072c4f00b0094f58a85bc5sm4056647ejc.180.2023.05.11.07.26.33 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 11 May 2023 07:26:33 -0700 (PDT) From: =?utf-8?q?Christian_G=C3=B6ttsche?= To: selinux@vger.kernel.org Cc: Jens Axboe , Alistair Delva , Bart Van Assche , Serge Hallyn , linux-block@vger.kernel.org, linux-kernel@vger.kernel.org, bpf@vger.kernel.org Subject: [PATCH v4 4/9] block: use new capable_any functionality Date: Thu, 11 May 2023 16:25:27 +0200 Message-Id: <20230511142535.732324-4-cgzones@googlemail.com> X-Mailer: git-send-email 2.40.1 In-Reply-To: <20230511142535.732324-1-cgzones@googlemail.com> References: <20230511142535.732324-1-cgzones@googlemail.com> MIME-Version: 1.0 X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FREEMAIL_FROM, RCVD_IN_DNSWL_NONE,SPF_HELO_NONE,SPF_PASS,T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1765608381514568745?= X-GMAIL-MSGID: =?utf-8?q?1765608381514568745?= Use the new added capable_any function in appropriate cases, where a task is required to have any of two capabilities. Reorder CAP_SYS_ADMIN last. Fixes: 94c4b4fd25e6 ("block: Check ADMIN before NICE for IOPRIO_CLASS_RT") Signed-off-by: Christian Göttsche --- v3: rename to capable_any() --- block/ioprio.c | 9 +-------- 1 file changed, 1 insertion(+), 8 deletions(-) diff --git a/block/ioprio.c b/block/ioprio.c index 32a456b45804..0a7df88bf6d9 100644 --- a/block/ioprio.c +++ b/block/ioprio.c @@ -37,14 +37,7 @@ int ioprio_check_cap(int ioprio) switch (class) { case IOPRIO_CLASS_RT: - /* - * Originally this only checked for CAP_SYS_ADMIN, - * which was implicitly allowed for pid 0 by security - * modules such as SELinux. Make sure we check - * CAP_SYS_ADMIN first to avoid a denial/avc for - * possibly missing CAP_SYS_NICE permission. - */ - if (!capable(CAP_SYS_ADMIN) && !capable(CAP_SYS_NICE)) + if (!capable_any(CAP_SYS_NICE, CAP_SYS_ADMIN)) return -EPERM; fallthrough; /* rt has prio field too */ From patchwork Thu May 11 14:25:28 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Christian_G=C3=B6ttsche?= X-Patchwork-Id: 92655 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a05:6358:3046:b0:115:7a1d:dabb with SMTP id p6csp4484053rwl; Thu, 11 May 2023 07:35:28 -0700 (PDT) X-Google-Smtp-Source: ACHHUZ5xZ1Jyj6GeUjMy4WPBNZ2lGxB9HuS955owd0MWHEzAVNWZbEUXHYOAkXxtWw1NlGD0iPif X-Received: by 2002:a17:903:2347:b0:1a9:91d7:ba2 with SMTP id c7-20020a170903234700b001a991d70ba2mr26956604plh.48.1683815728485; Thu, 11 May 2023 07:35:28 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1683815728; cv=none; d=google.com; s=arc-20160816; b=PODjryjNkbtTj7p8AQnx6OOVvdlGTbS8Mx8Cl73P8yDDdwKzuRbNhiWQ2zPEGW191G Sxb4nsJAwM+/xqxr8m6NugqUkvYEK2Dq2yDBV9Bf77oI8M5U1bxYUXDXt1MChr58zV+8 F3uOtuncWY0nrtU7ahc7s8VJ3eAAyvh5iohjVDJ0gTf9Iwe5RsAuGB3ZCuuxK3Cg9TEW 6rwpOOkCOffjxbRPqkokm2hLI/MOR+eFb52x5hsRTzHVKRguL/wM88NmfU8pZVFShr1m RRyBMtGZBuabb4d/hPtSM0TkDJ5TfCZqXdwB22X9ehatkj6RHmlUcQ/ZG8lt2uz1KNDC T3eA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=NuRohinkfnfKmQ5A0D+/nPSG9lRUGHQe+yhHKcHJQxc=; b=jgDpQtModmLLbhWn0RI+lq5wUQ47pu0e0/dGRa+jhWcwr2enQfzdpt9iIe2dUsjazy s90A5aAgJfk7JI5wpwfgFnmAHn3yTcuWVDBGCFsAw7Rt+DC0PdRp4yYwoRKG6BvhKwaA qpdea5FPHroRqgmll3ETNDwVusEuytwEc0YsKmAc8jAlWbheusNyhXOU3QeHJLVhtRJY 2Cva2+ZLnEG0Xib7tpfADGJHjpvtBj4P8z1yme8CN1l2AFWZZHmUzNvrbZWRJpCdcqfI KCjjSsKw1KVSwotVcqezz0YhS6E9AEfwabyND8gGT84FbJIIVQD4LkL9y2lQVXv8Oyzk 7PTw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@googlemail.com header.s=20221208 header.b=LtK1dCAh; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=googlemail.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id n13-20020a170902d2cd00b001a6dfb34f89si1184097plc.386.2023.05.11.07.35.14; Thu, 11 May 2023 07:35:28 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@googlemail.com header.s=20221208 header.b=LtK1dCAh; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=googlemail.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238249AbjEKO13 (ORCPT + 99 others); Thu, 11 May 2023 10:27:29 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42812 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S238200AbjEKO0w (ORCPT ); Thu, 11 May 2023 10:26:52 -0400 Received: from mail-ed1-x535.google.com (mail-ed1-x535.google.com [IPv6:2a00:1450:4864:20::535]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 0768D100D9; Thu, 11 May 2023 07:26:38 -0700 (PDT) Received: by mail-ed1-x535.google.com with SMTP id 4fb4d7f45d1cf-50bdd7b229cso15780021a12.0; Thu, 11 May 2023 07:26:38 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlemail.com; s=20221208; t=1683815197; x=1686407197; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=NuRohinkfnfKmQ5A0D+/nPSG9lRUGHQe+yhHKcHJQxc=; b=LtK1dCAhlTv//hzdt2MS3tcXcqmmZZ8Uq+ljdJNnuuCglgmhmm9NuHsu73nfpcQlSJ Oe1i6sin4+SziCfaxmajG9Mop1DS3VAV89W3M9GwqfL2NqFBqcZRlnBK7rAoWVLECKju QGLD6uMlpZNvfWHqc4hYTnnbHRI14zXMNpVgR3YjZSl8eED7DDP48pupvBdwHhlEzDjG dGIUFk34vfcb+AN0naBTlDjc46KrhjdmBFRxdbe2hO6F0EgKmzkvTETHjHMcwwMCMk2q R7pJ+d5SeSJeDn75IkxGfZ4fKQP589sMALN7ukmg6zahdU4e3DmKP7/1Or8+YvChH745 uW7Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1683815197; x=1686407197; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=NuRohinkfnfKmQ5A0D+/nPSG9lRUGHQe+yhHKcHJQxc=; b=ZyupoRAqPzCmJQjElv2ieiEOaTbdrRzbMk+F/TtU2muO3o84z9INJj6megvVlltFZD QKtuwNjDrCSn80fRTmvBdwwPsQX8BG5bJhlGjbiemBdy9S9Moj0VW/qDbxzXBOVHdmjV c1z5sgBXqDUDsnscosMDHT1dOCn7jeMQTZgkYQ51oDCtnzzxLFzAfRGnnomwIbXP1cum +zeQ1YeXY7bctEU93s2Qkjwo1BKwZi2MDVSmWjridNHqeKxgjU4vP2sRMKUnMqlT0Udg lAx1iCzUXGFCpDOAeNPqle/Dk1dje98fHycA/Xw802tIUkV1vv85A+MEC2shbPTioX5g NyRQ== X-Gm-Message-State: AC+VfDx6IK6xrg5gjRgM1PApJ+70ZCFwIyy8biQPZxtE2p26RfBFzFCi 9nkktWXHdaPxZRyYQIF+iaSejuxFv5nYag== X-Received: by 2002:a17:907:720e:b0:966:5a6c:752d with SMTP id dr14-20020a170907720e00b009665a6c752dmr13444473ejc.20.1683815197050; Thu, 11 May 2023 07:26:37 -0700 (PDT) Received: from debianHome.localdomain (dynamic-077-008-180-228.77.8.pool.telefonica.de. [77.8.180.228]) by smtp.gmail.com with ESMTPSA id hf15-20020a1709072c4f00b0094f58a85bc5sm4056647ejc.180.2023.05.11.07.26.35 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 11 May 2023 07:26:35 -0700 (PDT) From: =?utf-8?q?Christian_G=C3=B6ttsche?= To: selinux@vger.kernel.org Cc: Felix Kuehling , Alex Deucher , =?utf-8?q?Christian_K=C3=B6nig?= , "Pan, Xinhui" , David Airlie , Daniel Vetter , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Stefan Haberland , Jan Hoeppner , Heiko Carstens , Vasily Gorbik , Alexander Gordeev , Christian Borntraeger , Sven Schnelle , amd-gfx@lists.freedesktop.org, dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, linux-s390@vger.kernel.org, bpf@vger.kernel.org Subject: [PATCH v4 5/9] drivers: use new capable_any functionality Date: Thu, 11 May 2023 16:25:28 +0200 Message-Id: <20230511142535.732324-5-cgzones@googlemail.com> X-Mailer: git-send-email 2.40.1 In-Reply-To: <20230511142535.732324-1-cgzones@googlemail.com> References: <20230511142535.732324-1-cgzones@googlemail.com> MIME-Version: 1.0 X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FREEMAIL_FROM, RCVD_IN_DNSWL_NONE,SPF_HELO_NONE,SPF_PASS,T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1765608761151750849?= X-GMAIL-MSGID: =?utf-8?q?1765608761151750849?= Use the new added capable_any function in appropriate cases, where a task is required to have any of two capabilities. Reorder CAP_SYS_ADMIN last. Signed-off-by: Christian Göttsche Acked-by: Alexander Gordeev --- v4: Additional usage in kfd_ioctl() v3: rename to capable_any() --- drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 3 +-- drivers/net/caif/caif_serial.c | 2 +- drivers/s390/block/dasd_eckd.c | 2 +- 3 files changed, 3 insertions(+), 4 deletions(-) diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c index 1b54a9aaae70..d21fb9d1556b 100644 --- a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c +++ b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c @@ -2896,8 +2896,7 @@ static long kfd_ioctl(struct file *filep, unsigned int cmd, unsigned long arg) * more priviledged access. */ if (unlikely(ioctl->flags & KFD_IOC_FLAG_CHECKPOINT_RESTORE)) { - if (!capable(CAP_CHECKPOINT_RESTORE) && - !capable(CAP_SYS_ADMIN)) { + if (!capable_any(CAP_CHECKPOINT_RESTORE, CAP_SYS_ADMIN)) { retcode = -EACCES; goto err_i1; } diff --git a/drivers/net/caif/caif_serial.c b/drivers/net/caif/caif_serial.c index 688075859ae4..ca3f82a0e3a6 100644 --- a/drivers/net/caif/caif_serial.c +++ b/drivers/net/caif/caif_serial.c @@ -326,7 +326,7 @@ static int ldisc_open(struct tty_struct *tty) /* No write no play */ if (tty->ops->write == NULL) return -EOPNOTSUPP; - if (!capable(CAP_SYS_ADMIN) && !capable(CAP_SYS_TTY_CONFIG)) + if (!capable_any(CAP_SYS_TTY_CONFIG, CAP_SYS_ADMIN)) return -EPERM; /* release devices to avoid name collision */ diff --git a/drivers/s390/block/dasd_eckd.c b/drivers/s390/block/dasd_eckd.c index ade1369fe5ed..67d1058bce1b 100644 --- a/drivers/s390/block/dasd_eckd.c +++ b/drivers/s390/block/dasd_eckd.c @@ -5370,7 +5370,7 @@ static int dasd_symm_io(struct dasd_device *device, void __user *argp) char psf0, psf1; int rc; - if (!capable(CAP_SYS_ADMIN) && !capable(CAP_SYS_RAWIO)) + if (!capable_any(CAP_SYS_RAWIO, CAP_SYS_ADMIN)) return -EACCES; psf0 = psf1 = 0; From patchwork Thu May 11 14:25:29 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Christian_G=C3=B6ttsche?= X-Patchwork-Id: 92657 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a05:6358:3046:b0:115:7a1d:dabb with SMTP id p6csp4485137rwl; Thu, 11 May 2023 07:36:57 -0700 (PDT) X-Google-Smtp-Source: ACHHUZ4lPG0IbBe2ydGAF56w2aS/q9GbOGrwhPVeUCiSu5kvbKbO4LiDG67CC0g+LP3JdBYFIuT8 X-Received: by 2002:a05:6a20:4315:b0:f0:9cbd:78e3 with SMTP id h21-20020a056a20431500b000f09cbd78e3mr26020854pzk.0.1683815817344; Thu, 11 May 2023 07:36:57 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1683815817; cv=none; d=google.com; s=arc-20160816; b=Q02pqkLAfJtiizRI2Q+2vmbwtqHaUfw30Vrlsh608Gjp7TuwEZQzJYFoXZUM35FdK5 x0/aR/E6kjUc7TjhsqXjU8piE3XOxit08i+Ns0dnesOHo6RJhwItYHc3oiC+yWne33Iy Sdtg56Xd1CQpxqrMFvCzKBNQx/AYB0+iCQBcRvWmHVzbO3B9Iwu0lnZrTOBZkhc9qPuC vYlrGg8B5XMaVj/9pg2eByxDHQi42/sI/wKnM12rwlNg5JdNw0Sm5CZKOl4kH+WPmi91 stmbXpekfS5bLZgGq7RFa3dvmbunrhAepZmlTbi69FL9apqxaMbYq/FcSJLoqllB0r10 HbiQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=COA3OKhGOWcRWHzvnj/0MR1RJBS6NTQDYtZ3E92nD9k=; b=eYfLxdcGvNoorLfAosaHTdxSVHQNr3SH2zQtUrdgwvPV4sFfNGThQb/9vL7RonxAEO WwANwYHbzUd4WSlUATRCJPJvWi6IL3YJLdNAWkIhRwqprreitas46pn0ZACH6l8gfdKA HVHqkl4mX9ikDIB6ZQHkv6XpddNDAXVlJD5HQDmZGEP9xUXDABGGjQyvn18eEviOOSNT obJtm7krgqFbR+bKREk6Pxc//YdsBrPW+m4fuc/J7r/qIzw5nucI3o0u3CWiHhcK6Ipq zixPEke7ydHWZqVKwxuM2VRwtOD+1/SqraDfTETgV6QVS50fVPXQpnDYo9bzr3ObS4qX Pj2w== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@googlemail.com header.s=20221208 header.b="KprNXu/0"; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=googlemail.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id bu18-20020a632952000000b0053072cbae6bsi2193661pgb.383.2023.05.11.07.36.43; Thu, 11 May 2023 07:36:57 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@googlemail.com header.s=20221208 header.b="KprNXu/0"; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=googlemail.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238107AbjEKO1b (ORCPT + 99 others); Thu, 11 May 2023 10:27:31 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:47062 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S238264AbjEKO0y (ORCPT ); Thu, 11 May 2023 10:26:54 -0400 Received: from mail-ej1-x62f.google.com (mail-ej1-x62f.google.com [IPv6:2a00:1450:4864:20::62f]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 0F8B310A1F; Thu, 11 May 2023 07:26:39 -0700 (PDT) Received: by mail-ej1-x62f.google.com with SMTP id a640c23a62f3a-9619095f479so1394099866b.1; Thu, 11 May 2023 07:26:39 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlemail.com; s=20221208; t=1683815198; x=1686407198; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=COA3OKhGOWcRWHzvnj/0MR1RJBS6NTQDYtZ3E92nD9k=; b=KprNXu/0rjC72VYIYbLSUyTkcWBQ5X6n2YqUusFCTLphcDoM4whOOylOtBRBO31LJm tecL+59ZQHLa98Ej5kve9mTf02PRKA1IDaBFXmLnDhWb34ivlXQmmnAOd1n9dir3vg5k TZgccFs5V0k8f1j44UY/WAim3TzSOA/qS+EsOLGyqdxgvuLFge8Yty7M4CnMd1iENzQt rcuWf2y/0AA7uls97GtL+ipCeJQVry5uZIEe7WIrWCZls9hLraORJDRSMUER3iLvR9+b UE9Kh7Iy2uC8BtGrX7J6Rt3NV+doenwkdkKGoU1ECfMb1gkzfzSHkFXGHudBU1D3QK0M FRxA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1683815198; x=1686407198; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=COA3OKhGOWcRWHzvnj/0MR1RJBS6NTQDYtZ3E92nD9k=; b=cMXvxIQsHSJBv83Y1WdvFqM8fsu/1xDc0sIzYzBJP8BMbVFy1pN7KiFzMyLAhkRIn1 MPTxHPumgsq8+F+r01zDQc5Mj1lXFfyLb2mvTyAeeaK04a/kW0mqZpplBlf+cx+xnwY8 ffBXZToflcaN/uFv8p3xOJYYAxvkIx06E1inG1crz109BTFlgKPUFcw5M4DIvaeI84fH YmYEmXZ5/N9SNlEK6tPPROxWJmOOjfL0OvZknm3lFJi3O/YiyN1xCw3J3Dgxq7rX8udG 24sP2+rOpRObpAgdHvzU6oCiCk328UbU26M8f7ER8+l5fioUd6bq8GvVbdRn3z6kXjfe fNjQ== X-Gm-Message-State: AC+VfDzUotiGoEbHqDvGwhDZXYdJvHaCyAvKnC18kJhoC61ockUgSBDW i3FcFVq8SmaI+ooGuRXtyJnzY2BWWsyPSA== X-Received: by 2002:a17:906:5d16:b0:960:f1a6:69df with SMTP id g22-20020a1709065d1600b00960f1a669dfmr23521045ejt.36.1683815198256; Thu, 11 May 2023 07:26:38 -0700 (PDT) Received: from debianHome.localdomain (dynamic-077-008-180-228.77.8.pool.telefonica.de. [77.8.180.228]) by smtp.gmail.com with ESMTPSA id hf15-20020a1709072c4f00b0094f58a85bc5sm4056647ejc.180.2023.05.11.07.26.37 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 11 May 2023 07:26:37 -0700 (PDT) From: =?utf-8?q?Christian_G=C3=B6ttsche?= To: selinux@vger.kernel.org Cc: Alexander Viro , Christian Brauner , linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org, bpf@vger.kernel.org Subject: [PATCH v4 6/9] fs: use new capable_any functionality Date: Thu, 11 May 2023 16:25:29 +0200 Message-Id: <20230511142535.732324-6-cgzones@googlemail.com> X-Mailer: git-send-email 2.40.1 In-Reply-To: <20230511142535.732324-1-cgzones@googlemail.com> References: <20230511142535.732324-1-cgzones@googlemail.com> MIME-Version: 1.0 X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FREEMAIL_FROM, RCVD_IN_DNSWL_NONE,SPF_HELO_NONE,SPF_PASS,T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1765608854471517806?= X-GMAIL-MSGID: =?utf-8?q?1765608854471517806?= Use the new added capable_any function in appropriate cases, where a task is required to have any of two capabilities. Signed-off-by: Christian Göttsche Acked-by: Christian Brauner --- v3: rename to capable_any() --- fs/pipe.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/pipe.c b/fs/pipe.c index ceb17d2dfa19..05c64494d37b 100644 --- a/fs/pipe.c +++ b/fs/pipe.c @@ -776,7 +776,7 @@ bool too_many_pipe_buffers_hard(unsigned long user_bufs) bool pipe_is_unprivileged_user(void) { - return !capable(CAP_SYS_RESOURCE) && !capable(CAP_SYS_ADMIN); + return !capable_any(CAP_SYS_RESOURCE, CAP_SYS_ADMIN); } struct pipe_inode_info *alloc_pipe_info(void) From patchwork Thu May 11 14:25:30 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Christian_G=C3=B6ttsche?= X-Patchwork-Id: 92661 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:b0ea:0:b0:3b6:4342:cba0 with SMTP id b10csp4429150vqo; Thu, 11 May 2023 07:44:19 -0700 (PDT) X-Google-Smtp-Source: ACHHUZ40qn/nQaTXAK7GGqn6jiMXahXpK30kwQJR6bOUomyydBhv8jjqoFm/7Ydx5aCyjFBGOpBM X-Received: by 2002:a17:90a:e645:b0:247:35f8:81d2 with SMTP id ep5-20020a17090ae64500b0024735f881d2mr21345071pjb.29.1683816259041; Thu, 11 May 2023 07:44:19 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1683816259; cv=none; d=google.com; s=arc-20160816; b=Go7dI/0qGbzrY+XSk7mJHWLQilf3iCtjw3MS9BKTwN4KLPRoki0wRnZgr/AX/gJ7KQ DlauTAaL4jww0AbD3pmSJcmLZxQl3jVrlYpa6ZB2cLD2Aho48xA7snFxMU+ZZZ8WS/Jt 5tTaKDPqbijWfGerEUYEq+aWC04N5nMM4DREyZdY+Qf1nXrXPTD+hrR3utZKcIEey5Dp 292E9EQBb66zyg7tsdsvoAeOlWS0WypK/484ylEUeb0pFvN/Y9KoeRpEIIQ6fXppqCLW eq4apDm8+H71hwu6A00MMjNIT74800KtrgFGxoxjIK3JdpXksX6QNIa54CKL0Bab3ktS rKIg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=omcL1tQTkN45wCKai+1Kbbd8238ac0Z+pI3Znyzufew=; b=HoZ3nCqyPjbzvFa/LyARjvDUg5f6zZY9dVCLKXMF50KsEoVr7g5PMiVGOg7xkVz93Z 5880bGCAnqwn/kP/S3TaPVA5F4pTC+M9VvGNsIX4iXYM9Xol5TnFvXe/XLdNYNW1zpNA 1vNjlZpdWdzXuDjmdxqqsDNXMbubVfchV9UxkdpqiyhUBnOOoIIBEY1ohI/0wl1Kl0i1 V4pQWLesAIGga1I+JtmM8/Cp7TxuRewYiF95rbdnvKYEFUWETW8Fcr3u1QnNS9F5juuN 7M6v24e4213ss3frnQtbqWeOjGy938Afs2q+6TLLvV3MtKW+gxRhdUOjBp4CMn8ax131 Rg5w== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@googlemail.com header.s=20221208 header.b=rKqibNf1; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=googlemail.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id mp14-20020a17090b190e00b0024696599329si20588749pjb.77.2023.05.11.07.44.06; Thu, 11 May 2023 07:44:19 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@googlemail.com header.s=20221208 header.b=rKqibNf1; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=googlemail.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238110AbjEKO1j (ORCPT + 99 others); Thu, 11 May 2023 10:27:39 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42316 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S238389AbjEKO06 (ORCPT ); Thu, 11 May 2023 10:26:58 -0400 Received: from mail-ed1-x534.google.com (mail-ed1-x534.google.com [IPv6:2a00:1450:4864:20::534]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 09A1711568; Thu, 11 May 2023 07:26:41 -0700 (PDT) Received: by mail-ed1-x534.google.com with SMTP id 4fb4d7f45d1cf-50bd2d7ba74so79896065a12.1; Thu, 11 May 2023 07:26:41 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlemail.com; s=20221208; t=1683815200; x=1686407200; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=omcL1tQTkN45wCKai+1Kbbd8238ac0Z+pI3Znyzufew=; b=rKqibNf1l2a12KI79rqt5KPK4zm1S3BNWMM35Ahix1Jc8c38zD5DWVJbqB66b+JtD3 HDU694w3CQsEfsLkGWy0XOzhc04GoQn67u1tAxOkUHBAHSyWwR2C0rvfTjwL9x6lzlLs 6Gma1AQHwBXhb9DLBkBYQivjRJN3QLF93mnwRSqrsxW7RtI0Tzqn0cYU2e/IlQacAzSQ THkQ3suYfAAtNs7YgMY3bW0jn9CjozSNmVMRZTbSompRGyVpVRWzGgDRvDMwQt/743i/ Sl2JgX/H2nT3b/MUg4lk+1Pb5Q7m7krVG5qak/G1XHT47hcHnmrbGGUnc5Lus57t72sL 6KUA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1683815200; x=1686407200; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=omcL1tQTkN45wCKai+1Kbbd8238ac0Z+pI3Znyzufew=; b=hpRoIZRMIPq8Awpp7AUQuW9wovA3V9TcS48ycEk9k0OPyrHV7XhkUkunQu5nJEbJjy Kcme4BMHJuD07XDHPLidTP06SBxWuCDm3UncRo24mhySO/IOrN7mLMI4UX1EzQ3Bk00z Kl/BGCf1n3HL/Fgii6RrKoJ9/4UV90xDiSW7H7guHOdN45ZYLL3W+ost1t0x60V3iBck VUdZunxQo8RqEXEUUgW3Hu7oZLRokaHboiVkgsZDgIDYX01KV9m9FRgFwwEkmKGAqlkB lEDqA9U6C2yfvoPuqS3vG5UX+MOnZ+PJstNmW9QLZZXxvLkxRA75Zjj9335hMr9O7ud/ wM4g== X-Gm-Message-State: AC+VfDzt7iHoeac/KnCF1s+y8IuAzfrpd4HUKKkD/9QEzf/Vfo3RAE27 goam3nqTyM0u6otbzOHT58juKFO5IsVl8w== X-Received: by 2002:a17:907:1690:b0:94f:6316:ce8d with SMTP id hc16-20020a170907169000b0094f6316ce8dmr21600343ejc.34.1683815200236; Thu, 11 May 2023 07:26:40 -0700 (PDT) Received: from debianHome.localdomain (dynamic-077-008-180-228.77.8.pool.telefonica.de. [77.8.180.228]) by smtp.gmail.com with ESMTPSA id hf15-20020a1709072c4f00b0094f58a85bc5sm4056647ejc.180.2023.05.11.07.26.39 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 11 May 2023 07:26:39 -0700 (PDT) From: =?utf-8?q?Christian_G=C3=B6ttsche?= To: selinux@vger.kernel.org Cc: Andrew Morton , Christian Brauner , Suren Baghdasaryan , "Liam R. Howlett" , "Michael S. Tsirkin" , Mike Christie , Mathieu Desnoyers , Andrei Vagin , Nicholas Piggin , Peter Zijlstra , linux-kernel@vger.kernel.org, bpf@vger.kernel.org Subject: [PATCH v4 7/9] kernel: use new capable_any functionality Date: Thu, 11 May 2023 16:25:30 +0200 Message-Id: <20230511142535.732324-7-cgzones@googlemail.com> X-Mailer: git-send-email 2.40.1 In-Reply-To: <20230511142535.732324-1-cgzones@googlemail.com> References: <20230511142535.732324-1-cgzones@googlemail.com> MIME-Version: 1.0 X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FREEMAIL_FROM, RCVD_IN_DNSWL_NONE,SPF_HELO_NONE,SPF_PASS,T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1765609317239183646?= X-GMAIL-MSGID: =?utf-8?q?1765609317239183646?= Use the new added capable_any function in appropriate cases, where a task is required to have any of two capabilities. Signed-off-by: Christian Göttsche Reviewed-by: Christian Brauner --- v3: rename to capable_any() --- kernel/fork.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/fork.c b/kernel/fork.c index ed4e01daccaa..6e00933e8ef4 100644 --- a/kernel/fork.c +++ b/kernel/fork.c @@ -2371,7 +2371,7 @@ __latent_entropy struct task_struct *copy_process( retval = -EAGAIN; if (is_rlimit_overlimit(task_ucounts(p), UCOUNT_RLIMIT_NPROC, rlimit(RLIMIT_NPROC))) { if (p->real_cred->user != INIT_USER && - !capable(CAP_SYS_RESOURCE) && !capable(CAP_SYS_ADMIN)) + !capable_any(CAP_SYS_RESOURCE, CAP_SYS_ADMIN)) goto bad_fork_cleanup_count; } current->flags &= ~PF_NPROC_EXCEEDED; From patchwork Thu May 11 14:25:31 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Christian_G=C3=B6ttsche?= X-Patchwork-Id: 92651 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a05:6358:3046:b0:115:7a1d:dabb with SMTP id p6csp4479332rwl; Thu, 11 May 2023 07:29:07 -0700 (PDT) X-Google-Smtp-Source: ACHHUZ71hB/FuCeuDtbojzI8VPeqr7wBmhQ6AL9KyZ2N1L0aFurl/6CCrBuHw/sqm55ku/e2BJTa X-Received: by 2002:a17:902:ba89:b0:1aa:dba2:d15c with SMTP id k9-20020a170902ba8900b001aadba2d15cmr20165904pls.15.1683815346869; Thu, 11 May 2023 07:29:06 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1683815346; cv=none; d=google.com; s=arc-20160816; b=sZ05dZ9vYGyNsaeckTbpBxJE44UB7XP5uGavLkh23FPiiqCNwfz6lJ3t1MJMfd3tGw nMaYSE5AkIw4sPUURkb2QD71JT+Mwkcj/2tKmH9J3IAoo2ERgNgLnDttjOzL9HNo5Qt0 D5Y6D+IGJjeRD8BwqCc/HKdx56asedAuDDHrD9X+qyUXZJTODnj0jMivldW9Ip+QU7B/ Kug6v2ZoJzxund27OhACfWX1CAP22NFrqlOnp9C4TFeOTJ3SNdojkD0NEstWgTlZKqGN jrYH7Lk2yY8VgOMEr08WUxOBSLpZB9dAPOLRu6qzEu7lQBnPVgF2kFuchityBKDH4hlS Bo2w== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=NX1eGa2B4zwlKeG6BlsmclZE212qcwapZaeSouPQJvk=; b=ZWANyQICR1pQoeaUsyEuQ9CY8U7Cm2+CSsFrXj47Nw3QXpdTVvgjK1IzBvwBJ3Qqmp XaKYvBDZQRT0Rn2eZ+3cFiGFNPVXd3zq3GRX6KYEmtAw7yRqFttWBKcl5aX1+sXxeRR9 KQ7nif+HiCZxEqNh2+2WfAbS/6andJVzLsYhTZmISG5GOJO/9XyRknRxJp9TnlIOgJxs A+FCe+yn61aNSDWUCxf5gjDRaY22EYJFy0m2D1TKKO9LtVBi3WugpL5qnZihGJewBeLR hi8O/ABCriS+RnESA3Crb41gXV81diPMs/0lictcevub+d2vgbrgNNbpJ5tlvkVAmS8i 3h+w== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@googlemail.com header.s=20221208 header.b=eXB5yE1v; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=googlemail.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id h11-20020a170902748b00b001adc3a1b3fasi2034504pll.282.2023.05.11.07.28.53; Thu, 11 May 2023 07:29:06 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@googlemail.com header.s=20221208 header.b=eXB5yE1v; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=googlemail.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238533AbjEKO1o (ORCPT + 99 others); Thu, 11 May 2023 10:27:44 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46588 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S238443AbjEKO06 (ORCPT ); Thu, 11 May 2023 10:26:58 -0400 Received: from mail-ej1-x62e.google.com (mail-ej1-x62e.google.com [IPv6:2a00:1450:4864:20::62e]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 29E15106E2; Thu, 11 May 2023 07:26:43 -0700 (PDT) Received: by mail-ej1-x62e.google.com with SMTP id a640c23a62f3a-9659c5b14d8so1430154166b.3; Thu, 11 May 2023 07:26:43 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlemail.com; s=20221208; t=1683815201; x=1686407201; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=NX1eGa2B4zwlKeG6BlsmclZE212qcwapZaeSouPQJvk=; b=eXB5yE1v2WQ0PSpMfBeBo/WdgEpufMgmK/+iTeF5dgyEMjqGCtqfLLroXENpZ/Nnga 2gftvlN2sPWKeyAUul+z/Y0ktcMv4EXx4DJuQZ4+GY6vFD9ZwnfL0Aw5beQJZUJSrbtP Bn1w65DqCBQGjie3s35YNzURxW5H2DD90Ocfu2YioDvQmPGLozIsqhW/akKi0SnUIfi+ feOJUy4uJXjRqE6TxzYSbMjHOd8mWE9zhZZJ5xHgL5+48m5I4tUIc+1I16/MRAcn2Y+u To/boRZtv3+EcXS/bZv19RvBO59u3dTZTDeuK85XLNe/JwrmkknGA2ypOEZoMBlscFET TMBA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1683815201; x=1686407201; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=NX1eGa2B4zwlKeG6BlsmclZE212qcwapZaeSouPQJvk=; b=Uedu4RxLhqELAmG6r//nVcqoyP87eVGb1BbzmIc2fYCneVWSq/qVxpIvB64ioCYDsa KL4ZtTJZLmTrWvVuxuWXusDYfR7QBhpuDbahG1Ql8mnmOjgHndTeCq5h/UbwOhMtZcf1 lAcIPDGJL5Ug3nHLFIEDvTmty12ky2V8831GnnFNC/m4dt1xELXhorzcaniyCVUmR8OD Dadv4oDDpjyQAP38VV6lT46IJU5ajoBkzCyhGSAAIx2XzA+7ycRcQsAPZtcHO9hPntqE Kj8GZic2F+hH0uuX3Ihl3DHxEZy3lgphqMPHewkCMzd5TtraV6VdGc4ukt/TZr9WgtSx +GSA== X-Gm-Message-State: AC+VfDxHh0byo8z9J94RXfRA+4rDHHCyvGS5BE2V5YXmzR55eB/Ib6Xa VouHedFZPHCTZcIHdjYA5Vpmz3nqkQrioQ== X-Received: by 2002:a17:907:26c1:b0:965:eef3:f9b9 with SMTP id bp1-20020a17090726c100b00965eef3f9b9mr18589768ejc.29.1683815201440; Thu, 11 May 2023 07:26:41 -0700 (PDT) Received: from debianHome.localdomain (dynamic-077-008-180-228.77.8.pool.telefonica.de. [77.8.180.228]) by smtp.gmail.com with ESMTPSA id hf15-20020a1709072c4f00b0094f58a85bc5sm4056647ejc.180.2023.05.11.07.26.40 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 11 May 2023 07:26:41 -0700 (PDT) From: =?utf-8?q?Christian_G=C3=B6ttsche?= To: selinux@vger.kernel.org Cc: Alexei Starovoitov , Daniel Borkmann , John Fastabend , Andrii Nakryiko , Martin KaFai Lau , Song Liu , Yonghong Song , KP Singh , Stanislav Fomichev , Hao Luo , Jiri Olsa , bpf@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH v4 8/9] bpf: use new capable_any functionality Date: Thu, 11 May 2023 16:25:31 +0200 Message-Id: <20230511142535.732324-8-cgzones@googlemail.com> X-Mailer: git-send-email 2.40.1 In-Reply-To: <20230511142535.732324-1-cgzones@googlemail.com> References: <20230511142535.732324-1-cgzones@googlemail.com> MIME-Version: 1.0 X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FREEMAIL_FROM, RCVD_IN_DNSWL_NONE,SPF_HELO_NONE,SPF_PASS,T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1765608361387733245?= X-GMAIL-MSGID: =?utf-8?q?1765608361387733245?= Use the new added capable_any function in appropriate cases, where a task is required to have any of two capabilities. Signed-off-by: Christian Göttsche Acked-by: Andrii Nakryiko --- v3: rename to capable_any() --- kernel/bpf/syscall.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c index 14f39c1e573e..1bd50da05a22 100644 --- a/kernel/bpf/syscall.c +++ b/kernel/bpf/syscall.c @@ -2539,7 +2539,7 @@ static int bpf_prog_load(union bpf_attr *attr, bpfptr_t uattr, u32 uattr_size) !bpf_capable()) return -EPERM; - if (is_net_admin_prog_type(type) && !capable(CAP_NET_ADMIN) && !capable(CAP_SYS_ADMIN)) + if (is_net_admin_prog_type(type) && !capable_any(CAP_NET_ADMIN, CAP_SYS_ADMIN)) return -EPERM; if (is_perfmon_prog_type(type) && !perfmon_capable()) return -EPERM; From patchwork Thu May 11 14:25:32 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Christian_G=C3=B6ttsche?= X-Patchwork-Id: 92654 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a05:6358:3046:b0:115:7a1d:dabb with SMTP id p6csp4481950rwl; Thu, 11 May 2023 07:32:39 -0700 (PDT) X-Google-Smtp-Source: ACHHUZ7iNWFEhW9sHkRCM9vCjvok/gjrB1+QHh4NAOnETrtRkS5snjeNyufjfvsps99X3zk8F7fU X-Received: by 2002:a05:6a00:180f:b0:645:d02d:9a83 with SMTP id y15-20020a056a00180f00b00645d02d9a83mr21519080pfa.17.1683815558966; Thu, 11 May 2023 07:32:38 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1683815558; cv=none; d=google.com; s=arc-20160816; b=vjH7OHuJzLSfzndCUS6+Cn+Z5Q9K2d2SSdGuflGfcU5xoJSlCggcWrZRPzFrp1ofbV 5wVJ5hg9UN8Rwf1XIOcGsuMVQj+USjOqY5ozJt1epjQhaVDVg6gOd6xoy1AbLdlIdxWg OQ2wO1de0VGCWwdOTqOTSghUt/xADdX9ExTljD5HGsecuV8jXTNi1pIBGwbQJF/H9SJO 6Pz9h5jK/OtkUirctWyBShpkZ6JkUTq6rk6i3S7PiQZ7JT1kBZON8xeoMT8p5HfZK5st DARZQJJlfICgsGMNBakpiB2tyStV/rvBKLpxMrA3Tph8tARfaFp0W+ksjeoEXOY3pTCZ PerA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=yh+kmOB/3T2Ct+e48ke7ddrVyWc5FzCqMfagVQ+ockI=; b=b1QAPaiYUItasHc/EBQfyGBjrLScrRlC+zILuNADte9b5XtiQI+X+7kEqPZP5LLp9q K92lSTLsNL2h8SNxf/kVGt2ouzmveDOr4cpNZUlCQ6GhlUwbS42VpzI5AJTTCTNl544Q TGSOTDHPx2JMP7Hu8PzCYYVPYNy9tPKT7wVK71ZyZ2nfwaviUTjSX9u7Ynhid1YY4nKU ElVG5BqWa+pIl6vQmvHbqY9Dy381d179GrEAys19XszWZO+ON780lEOGKSnWX0lG4XeE eCIBs0cldQy0ZhoeuEFNruHopN/W2tBYCEMyL/eZ1JEfB2RL6vOSN1NjgfONRFSCOmYO 1MIA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@googlemail.com header.s=20221208 header.b=mR9aqKYi; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=googlemail.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id t67-20020a625f46000000b0063b76333d9asi7755792pfb.217.2023.05.11.07.32.26; Thu, 11 May 2023 07:32:38 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@googlemail.com header.s=20221208 header.b=mR9aqKYi; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=googlemail.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238169AbjEKO2A (ORCPT + 99 others); Thu, 11 May 2023 10:28:00 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43424 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237976AbjEKO1R (ORCPT ); Thu, 11 May 2023 10:27:17 -0400 Received: from mail-ej1-x62a.google.com (mail-ej1-x62a.google.com [IPv6:2a00:1450:4864:20::62a]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 089C0E72; Thu, 11 May 2023 07:26:49 -0700 (PDT) Received: by mail-ej1-x62a.google.com with SMTP id a640c23a62f3a-965ac4dd11bso1723548966b.2; Thu, 11 May 2023 07:26:48 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlemail.com; s=20221208; t=1683815207; x=1686407207; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=yh+kmOB/3T2Ct+e48ke7ddrVyWc5FzCqMfagVQ+ockI=; b=mR9aqKYicwMhgogcBnAWcdWjqogQ/c966GYPXq2hztmeo7By9ge9YtvNNVBIBOjCAU 92/2QZ+ONIbYxFkUA79jMjYwJrHgIchmcwyQ+IH1HZAJX3m6JJEq2KyQNvqZaSlzq6Fx Gt0qJ+2K3/5BEPKoqxysmvLFVMv/tPjGoFE5oJ3L+JGRRJipYB7b5kWJsnJTvP/8r4sI AL0DxwnAsD/2HvZkicFCgrxdib1N1YI95aYIY0aanJcnsHrRjdcPxWaqpHoSeHoXgulh nXgY15ThHUUs5d05k9LT1s98tveFZZvlLfRZeCSOL0NkJtmPG++KIatLJDx0KS0+86Nl i9xQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1683815207; x=1686407207; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=yh+kmOB/3T2Ct+e48ke7ddrVyWc5FzCqMfagVQ+ockI=; b=RG3ajnOHsuLldcTD3zgTh7gF02yKXeGWEuUiyFvRvAsZghEj64WaB3f94pKsoLTgMb vKh5qZGIbP38111GLW4PynxIFH7V1DUZ/uGa0OMX7mmKPLXX368dSl68nFcq7lE9xAYf 6rjMW4uLw+/Lhsdvcds5BU8NdmUYRH7+HsYoQjYdERKzB66Q024jjb4+hziKobMIKODA x5qiQ5LCe6hOz5doYwArNduSgrs5TAIvHYu+GprRYJU5Ix22OrsmI7Mxrx6SkYD+qtq1 5FFVur+ovBfYAPXUtOO8nKyUA3yKaq3KP59mE6fGMmqP6qCUC5eWwNJU7O5dHm7pw7/9 9yxQ== X-Gm-Message-State: AC+VfDwnK8XV0Ydw2PYF8QuhBCV64rsnedseLT7G6hIEh4Ln+ryrTOOY W2Q2ULew9SALUjrE9Sphd8e4tnmtbAmaTg== X-Received: by 2002:a17:907:1c88:b0:961:be96:b0e0 with SMTP id nb8-20020a1709071c8800b00961be96b0e0mr20141790ejc.73.1683815207515; Thu, 11 May 2023 07:26:47 -0700 (PDT) Received: from debianHome.localdomain (dynamic-077-008-180-228.77.8.pool.telefonica.de. [77.8.180.228]) by smtp.gmail.com with ESMTPSA id hf15-20020a1709072c4f00b0094f58a85bc5sm4056647ejc.180.2023.05.11.07.26.44 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 11 May 2023 07:26:45 -0700 (PDT) From: =?utf-8?q?Christian_G=C3=B6ttsche?= To: selinux@vger.kernel.org Cc: "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Alexander Aring , Stefan Schmidt , Miquel Raynal , David Ahern , Keith Busch , Kuniyuki Iwashima , Christophe JAILLET , Alexei Starovoitov , Martin KaFai Lau , Xin Long , Alexander Duyck , Jason Xing , Jens Axboe , Pavel Begunkov , netdev@vger.kernel.org, linux-kernel@vger.kernel.org, linux-wpan@vger.kernel.org, bpf@vger.kernel.org Subject: [PATCH v4 9/9] net: use new capable_any functionality Date: Thu, 11 May 2023 16:25:32 +0200 Message-Id: <20230511142535.732324-9-cgzones@googlemail.com> X-Mailer: git-send-email 2.40.1 In-Reply-To: <20230511142535.732324-1-cgzones@googlemail.com> References: <20230511142535.732324-1-cgzones@googlemail.com> MIME-Version: 1.0 X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FREEMAIL_FROM, RCVD_IN_DNSWL_NONE,SPF_HELO_NONE,SPF_PASS,T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1765608583765195367?= X-GMAIL-MSGID: =?utf-8?q?1765608583765195367?= Use the new added capable_any function in appropriate cases, where a task is required to have any of two capabilities. Add sock_ns_capable_any() wrapper similar to existing sock_ns_capable() one. Reorder CAP_SYS_ADMIN last. Signed-off-by: Christian Göttsche Reviewed-by: Miquel Raynal --- v4: - introduce sockopt_ns_capable_any() v3: - rename to capable_any() - make use of ns_capable_any Signed-off-by: Christian Göttsche --- include/net/sock.h | 1 + net/caif/caif_socket.c | 2 +- net/core/sock.c | 18 ++++++++++-------- net/ieee802154/socket.c | 6 ++---- net/ipv4/ip_sockglue.c | 4 ++-- net/ipv6/ipv6_sockglue.c | 3 +-- net/unix/scm.c | 2 +- 7 files changed, 18 insertions(+), 18 deletions(-) diff --git a/include/net/sock.h b/include/net/sock.h index 8b7ed7167243..a17178e31e91 100644 --- a/include/net/sock.h +++ b/include/net/sock.h @@ -1762,6 +1762,7 @@ static inline void unlock_sock_fast(struct sock *sk, bool slow) void sockopt_lock_sock(struct sock *sk); void sockopt_release_sock(struct sock *sk); bool sockopt_ns_capable(struct user_namespace *ns, int cap); +bool sockopt_ns_capable_any(struct user_namespace *ns, int cap1, int cap2); bool sockopt_capable(int cap); /* Used by processes to "lock" a socket state, so that diff --git a/net/caif/caif_socket.c b/net/caif/caif_socket.c index 4eebcc66c19a..6dcc08f9da3b 100644 --- a/net/caif/caif_socket.c +++ b/net/caif/caif_socket.c @@ -1027,7 +1027,7 @@ static int caif_create(struct net *net, struct socket *sock, int protocol, .usersize = sizeof_field(struct caifsock, conn_req.param) }; - if (!capable(CAP_SYS_ADMIN) && !capable(CAP_NET_ADMIN)) + if (!capable_any(CAP_NET_ADMIN, CAP_SYS_ADMIN)) return -EPERM; /* * The sock->type specifies the socket type to use. diff --git a/net/core/sock.c b/net/core/sock.c index 5440e67bcfe3..6a236d649bec 100644 --- a/net/core/sock.c +++ b/net/core/sock.c @@ -1073,6 +1073,12 @@ bool sockopt_ns_capable(struct user_namespace *ns, int cap) } EXPORT_SYMBOL(sockopt_ns_capable); +bool sockopt_ns_capable_any(struct user_namespace *ns, int cap1, int cap2) +{ + return has_current_bpf_ctx() || ns_capable_any(ns, cap1, cap2); +} +EXPORT_SYMBOL(sockopt_ns_capable_any); + bool sockopt_capable(int cap) { return has_current_bpf_ctx() || capable(cap); @@ -1207,8 +1213,7 @@ int sk_setsockopt(struct sock *sk, int level, int optname, case SO_PRIORITY: if ((val >= 0 && val <= 6) || - sockopt_ns_capable(sock_net(sk)->user_ns, CAP_NET_RAW) || - sockopt_ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN)) + sockopt_ns_capable_any(sock_net(sk)->user_ns, CAP_NET_RAW, CAP_NET_ADMIN)) sk->sk_priority = val; else ret = -EPERM; @@ -1353,8 +1358,7 @@ int sk_setsockopt(struct sock *sk, int level, int optname, clear_bit(SOCK_PASSSEC, &sock->flags); break; case SO_MARK: - if (!sockopt_ns_capable(sock_net(sk)->user_ns, CAP_NET_RAW) && - !sockopt_ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN)) { + if (!sockopt_ns_capable_any(sock_net(sk)->user_ns, CAP_NET_RAW, CAP_NET_ADMIN)) { ret = -EPERM; break; } @@ -1362,8 +1366,7 @@ int sk_setsockopt(struct sock *sk, int level, int optname, __sock_set_mark(sk, val); break; case SO_RCVMARK: - if (!sockopt_ns_capable(sock_net(sk)->user_ns, CAP_NET_RAW) && - !sockopt_ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN)) { + if (!sockopt_ns_capable_any(sock_net(sk)->user_ns, CAP_NET_RAW, CAP_NET_ADMIN)) { ret = -EPERM; break; } @@ -2747,8 +2750,7 @@ int __sock_cmsg_send(struct sock *sk, struct cmsghdr *cmsg, switch (cmsg->cmsg_type) { case SO_MARK: - if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_RAW) && - !ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN)) + if (!ns_capable_any(sock_net(sk)->user_ns, CAP_NET_RAW, CAP_NET_ADMIN)) return -EPERM; if (cmsg->cmsg_len != CMSG_LEN(sizeof(u32))) return -EINVAL; diff --git a/net/ieee802154/socket.c b/net/ieee802154/socket.c index 1fa2fe041ec0..f9bc6cae4af9 100644 --- a/net/ieee802154/socket.c +++ b/net/ieee802154/socket.c @@ -904,8 +904,7 @@ static int dgram_setsockopt(struct sock *sk, int level, int optname, ro->want_lqi = !!val; break; case WPAN_SECURITY: - if (!ns_capable(net->user_ns, CAP_NET_ADMIN) && - !ns_capable(net->user_ns, CAP_NET_RAW)) { + if (!ns_capable_any(net->user_ns, CAP_NET_ADMIN, CAP_NET_RAW)) { err = -EPERM; break; } @@ -928,8 +927,7 @@ static int dgram_setsockopt(struct sock *sk, int level, int optname, } break; case WPAN_SECURITY_LEVEL: - if (!ns_capable(net->user_ns, CAP_NET_ADMIN) && - !ns_capable(net->user_ns, CAP_NET_RAW)) { + if (!ns_capable_any(net->user_ns, CAP_NET_ADMIN, CAP_NET_RAW)) { err = -EPERM; break; } diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c index b511ff0adc0a..4dd752743b84 100644 --- a/net/ipv4/ip_sockglue.c +++ b/net/ipv4/ip_sockglue.c @@ -1341,8 +1341,8 @@ int do_ip_setsockopt(struct sock *sk, int level, int optname, break; case IP_TRANSPARENT: - if (!!val && !sockopt_ns_capable(sock_net(sk)->user_ns, CAP_NET_RAW) && - !sockopt_ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN)) { + if (!!val && !sockopt_ns_capable_any(sock_net(sk)->user_ns, CAP_NET_RAW, + CAP_NET_ADMIN)) { err = -EPERM; break; } diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c index ae818ff46224..38aad44547e4 100644 --- a/net/ipv6/ipv6_sockglue.c +++ b/net/ipv6/ipv6_sockglue.c @@ -625,8 +625,7 @@ int do_ipv6_setsockopt(struct sock *sk, int level, int optname, break; case IPV6_TRANSPARENT: - if (valbool && !sockopt_ns_capable(net->user_ns, CAP_NET_RAW) && - !sockopt_ns_capable(net->user_ns, CAP_NET_ADMIN)) { + if (valbool && !sockopt_ns_capable_any(net->user_ns, CAP_NET_RAW, CAP_NET_ADMIN)) { retv = -EPERM; break; } diff --git a/net/unix/scm.c b/net/unix/scm.c index f9152881d77f..4d18187a5349 100644 --- a/net/unix/scm.c +++ b/net/unix/scm.c @@ -99,7 +99,7 @@ static inline bool too_many_unix_fds(struct task_struct *p) struct user_struct *user = current_user(); if (unlikely(user->unix_inflight > task_rlimit(p, RLIMIT_NOFILE))) - return !capable(CAP_SYS_RESOURCE) && !capable(CAP_SYS_ADMIN); + return !capable_any(CAP_SYS_RESOURCE, CAP_SYS_ADMIN); return false; }