From patchwork Tue Jul 18 22:25:23 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kees Cook X-Patchwork-Id: 9850015 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 925C960392 for ; Tue, 18 Jul 2017 22:30:36 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 7D2361FF13 for ; Tue, 18 Jul 2017 22:30:36 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 71B3028438; Tue, 18 Jul 2017 22:30:36 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.5 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,RCVD_IN_DNSWL_HI,RCVD_IN_SORBS_SPAM autolearn=unavailable version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 0E5671FF13 for ; Tue, 18 Jul 2017 22:30:36 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752500AbdGRW3y (ORCPT ); Tue, 18 Jul 2017 18:29:54 -0400 Received: from mail-pf0-f180.google.com ([209.85.192.180]:36731 "EHLO mail-pf0-f180.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752555AbdGRWZq (ORCPT ); Tue, 18 Jul 2017 18:25:46 -0400 Received: by mail-pf0-f180.google.com with SMTP id o88so11362092pfk.3 for ; Tue, 18 Jul 2017 15:25:46 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=b7y9xldfK2bUCrNqPxyNun3DiZg7nSnD5ruT42RFAyk=; b=Wywus9/mVydtPjQA1Ckv7df+ZbJnLYawNXO56yYGA9bGVa6Pv6d362Gz1X//isVCza bCGFaFCdWECGZVOPQyagWrEFxAUZAzB57ygPxaXKN0bOJAi00DbSE3FqY7Oan6esd/NW JT5ycPmZsvY0xUFX5RkX1bXXxqpSI3tUc6RjE= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=b7y9xldfK2bUCrNqPxyNun3DiZg7nSnD5ruT42RFAyk=; b=TK7eoxT+bRs4+LoIVAOQmJDwrYVEq0kQExC1Vf9tTcyrRMEBnUf93qbbi4CTX0PlPu hLwkIsM6AyyoZS+YJmQmQh6RzD5QwB6t11AwzOEkWl59ey3/js4qjbWlBxAzCT4u/GLq H1uKdKafZbpy7IA4mk3xLpwkvDJN3KpEMGR/oxTxvd/oSqESzcWLWMmluAtf8rWNB5eY wwAx1avvQgAU5+XQ2IJM0tjerQrkwRrVNH1SkTrXCuassdB+Tz1O4CMPUdcKgRkO45At p7xPXDig+Opj9TMKsKGz5YL80gVjCcmLK0Z7yt1ie28+dpEuUkeCTZv1uvfh/Sme4Ejw GEKQ== X-Gm-Message-State: AIVw112NrmlqfoV7Xct7FSmYQymZeBS0GYS8PKYi26rCy4soHrFOX70E ZaraEzvPk86pD6hK X-Received: by 10.84.141.131 with SMTP id 3mr4041402plv.224.1500416746085; Tue, 18 Jul 2017 15:25:46 -0700 (PDT) Received: from www.outflux.net (173-164-112-133-Oregon.hfc.comcastbusiness.net. [173.164.112.133]) by smtp.gmail.com with ESMTPSA id r62sm8552038pfl.45.2017.07.18.15.25.43 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 18 Jul 2017 15:25:43 -0700 (PDT) From: Kees Cook To: Andrew Morton Cc: Kees Cook , David Howells , John Johansen , Paul Moore , Stephen Smalley , Casey Schaufler , James Morris , "Eric W. Biederman" , "Serge E. Hallyn" , Tetsuo Handa , Andy Lutomirski , Linus Torvalds , linux-fsdevel@vger.kernel.org, linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH v3 02/15] exec: Rename bprm->cred_prepared to called_set_creds Date: Tue, 18 Jul 2017 15:25:23 -0700 Message-Id: <1500416736-49829-3-git-send-email-keescook@chromium.org> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1500416736-49829-1-git-send-email-keescook@chromium.org> References: <1500416736-49829-1-git-send-email-keescook@chromium.org> Sender: linux-fsdevel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-fsdevel@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP The cred_prepared bprm flag has a misleading name. It has nothing to do with the bprm_prepare_cred hook, and actually tracks if bprm_set_creds has been called. Rename this flag and improve its comment. Cc: David Howells Cc: John Johansen Cc: Paul Moore Cc: Stephen Smalley Cc: Casey Schaufler Cc: James Morris Signed-off-by: Kees Cook Acked-by: John Johansen Acked-by: James Morris Acked-by: Paul Moore --- fs/binfmt_flat.c | 2 +- fs/exec.c | 2 +- include/linux/binfmts.h | 8 ++++++-- security/apparmor/domain.c | 2 +- security/selinux/hooks.c | 2 +- security/smack/smack_lsm.c | 2 +- security/tomoyo/tomoyo.c | 2 +- 7 files changed, 12 insertions(+), 8 deletions(-) diff --git a/fs/binfmt_flat.c b/fs/binfmt_flat.c index 2edcefc0a294..a722530cc468 100644 --- a/fs/binfmt_flat.c +++ b/fs/binfmt_flat.c @@ -885,7 +885,7 @@ static int load_flat_shared_library(int id, struct lib_info *libs) * as we're past the point of no return and are dealing with shared * libraries. */ - bprm.cred_prepared = 1; + bprm.called_set_creds = 1; res = prepare_binprm(&bprm); diff --git a/fs/exec.c b/fs/exec.c index 904199086490..925c85a45d97 100644 --- a/fs/exec.c +++ b/fs/exec.c @@ -1547,7 +1547,7 @@ int prepare_binprm(struct linux_binprm *bprm) retval = security_bprm_set_creds(bprm); if (retval) return retval; - bprm->cred_prepared = 1; + bprm->called_set_creds = 1; memset(bprm->buf, 0, BINPRM_BUF_SIZE); return kernel_read(bprm->file, 0, bprm->buf, BINPRM_BUF_SIZE); diff --git a/include/linux/binfmts.h b/include/linux/binfmts.h index 9508b5f83c7e..36be5a67517a 100644 --- a/include/linux/binfmts.h +++ b/include/linux/binfmts.h @@ -25,8 +25,12 @@ struct linux_binprm { struct mm_struct *mm; unsigned long p; /* current top of mem */ unsigned int - cred_prepared:1,/* true if creds already prepared (multiple - * preps happen for interpreters) */ + /* + * True after the bprm_set_creds hook has been called once + * (multiple calls can be made via prepare_binprm() for + * binfmt_script/misc). + */ + called_set_creds:1, cap_effective:1,/* true if has elevated effective capabilities, * false if not; except for init which inherits * its parent's caps anyway */ diff --git a/security/apparmor/domain.c b/security/apparmor/domain.c index 001e133a3c8c..878407e023e3 100644 --- a/security/apparmor/domain.c +++ b/security/apparmor/domain.c @@ -350,7 +350,7 @@ int apparmor_bprm_set_creds(struct linux_binprm *bprm) const char *name = NULL, *info = NULL; int error = 0; - if (bprm->cred_prepared) + if (bprm->called_set_creds) return 0; ctx = cred_ctx(bprm->cred); diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index 819fd6858b49..0f1450a06b02 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -2327,7 +2327,7 @@ static int selinux_bprm_set_creds(struct linux_binprm *bprm) /* SELinux context only depends on initial program or script and not * the script interpreter */ - if (bprm->cred_prepared) + if (bprm->called_set_creds) return 0; old_tsec = current_security(); diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c index 658f5d8c7e76..7d4b2e221124 100644 --- a/security/smack/smack_lsm.c +++ b/security/smack/smack_lsm.c @@ -917,7 +917,7 @@ static int smack_bprm_set_creds(struct linux_binprm *bprm) struct superblock_smack *sbsp; int rc; - if (bprm->cred_prepared) + if (bprm->called_set_creds) return 0; isp = inode->i_security; diff --git a/security/tomoyo/tomoyo.c b/security/tomoyo/tomoyo.c index 130b4fa4f65f..d25b705360e0 100644 --- a/security/tomoyo/tomoyo.c +++ b/security/tomoyo/tomoyo.c @@ -76,7 +76,7 @@ static int tomoyo_bprm_set_creds(struct linux_binprm *bprm) * Do only if this function is called for the first time of an execve * operation. */ - if (bprm->cred_prepared) + if (bprm->called_set_creds) return 0; #ifndef CONFIG_SECURITY_TOMOYO_OMIT_USERSPACE_LOADER /*