| Message ID | 20220613202807.447694-1-mortonm@chromium.org (mailing list archive) |
|---|---|
| State | Superseded |
| Headers | show |
| Series | [1/2] security: Add LSM hook to setgroups() syscall | expand |
Hi Micah,
I love your patch! Yet something to improve:
[auto build test ERROR on linus/master]
[also build test ERROR on jmorris-security/next-testing kees/for-next/pstore v5.19-rc2 next-20220610]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch]
url: https://github.com/intel-lab-lkp/linux/commits/Micah-Morton/security-Add-LSM-hook-to-setgroups-syscall/20220614-050341
base: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git b13baccc3850ca8b8cccbf8ed9912dbaa0fdf7f3
config: um-i386_defconfig (https://download.01.org/0day-ci/archive/20220614/202206141053.xW4ze6oP-lkp@intel.com/config)
compiler: gcc-11 (Debian 11.3.0-3) 11.3.0
reproduce (this is a W=1 build):
# https://github.com/intel-lab-lkp/linux/commit/b21cba6f759a2a60439de4d0f85323ed745b3ade
git remote add linux-review https://github.com/intel-lab-lkp/linux
git fetch --no-tags linux-review Micah-Morton/security-Add-LSM-hook-to-setgroups-syscall/20220614-050341
git checkout b21cba6f759a2a60439de4d0f85323ed745b3ade
# save the config file
mkdir build_dir && cp config build_dir/.config
make W=1 O=build_dir ARCH=um SUBARCH=i386 SHELL=/bin/bash
If you fix the issue, kindly add following tag where applicable
Reported-by: kernel test robot <lkp@intel.com>
All error/warnings (new ones prefixed by >>):
kernel/groups.c: In function 'set_current_groups':
>> kernel/groups.c:143:13: warning: assignment discards 'const' qualifier from pointer target type [-Wdiscarded-qualifiers]
143 | old = current_cred();
| ^
>> kernel/groups.c:147:9: error: 'retval' undeclared (first use in this function)
147 | retval = security_task_fix_setgroups(new, old);
| ^~~~~~
kernel/groups.c:147:9: note: each undeclared identifier is reported only once for each function it appears in
vim +/retval +147 kernel/groups.c
126
127 /**
128 * set_current_groups - Change current's group subscription
129 * @group_info: The group list to impose
130 *
131 * Validate a group subscription and, if valid, impose it upon current's task
132 * security record.
133 */
134 int set_current_groups(struct group_info *group_info)
135 {
136 struct cred *new;
137 struct cred *old;
138
139 new = prepare_creds();
140 if (!new)
141 return -ENOMEM;
142
> 143 old = current_cred();
144
145 set_groups(new, group_info);
146
> 147 retval = security_task_fix_setgroups(new, old);
148 if (retval < 0)
149 goto error;
150
151 return commit_creds(new);
152
153 error:
154 abort_creds(new);
155 return retval;
156 }
157
Hi Micah,
I love your patch! Yet something to improve:
[auto build test ERROR on linus/master]
[also build test ERROR on kees/for-next/pstore v5.19-rc2 next-20220610]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch]
url: https://github.com/intel-lab-lkp/linux/commits/Micah-Morton/security-Add-LSM-hook-to-setgroups-syscall/20220614-050341
base: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git b13baccc3850ca8b8cccbf8ed9912dbaa0fdf7f3
config: hexagon-randconfig-r045-20220613 (https://download.01.org/0day-ci/archive/20220614/202206141343.mSI8gmLO-lkp@intel.com/config)
compiler: clang version 15.0.0 (https://github.com/llvm/llvm-project c97436f8b6e2718286e8496faf53a2c800e281cf)
reproduce (this is a W=1 build):
wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross
chmod +x ~/bin/make.cross
# https://github.com/intel-lab-lkp/linux/commit/b21cba6f759a2a60439de4d0f85323ed745b3ade
git remote add linux-review https://github.com/intel-lab-lkp/linux
git fetch --no-tags linux-review Micah-Morton/security-Add-LSM-hook-to-setgroups-syscall/20220614-050341
git checkout b21cba6f759a2a60439de4d0f85323ed745b3ade
# save the config file
mkdir build_dir && cp config build_dir/.config
COMPILER_INSTALL_PATH=$HOME/0day COMPILER=clang make.cross W=1 O=build_dir ARCH=hexagon SHELL=/bin/bash
If you fix the issue, kindly add following tag where applicable
Reported-by: kernel test robot <lkp@intel.com>
All errors (new ones prefixed by >>):
>> kernel/groups.c:143:6: error: assigning to 'struct cred *' from 'typeof (*((__current_thread_info->task)->cred)) *' (aka 'const struct cred *') discards qualifiers [-Werror,-Wincompatible-pointer-types-discards-qualifiers]
old = current_cred();
^ ~~~~~~~~~~~~~~
>> kernel/groups.c:147:2: error: use of undeclared identifier 'retval'
retval = security_task_fix_setgroups(new, old);
^
kernel/groups.c:148:6: error: use of undeclared identifier 'retval'
if (retval < 0)
^
kernel/groups.c:155:9: error: use of undeclared identifier 'retval'
return retval;
^
4 errors generated.
vim +143 kernel/groups.c
126
127 /**
128 * set_current_groups - Change current's group subscription
129 * @group_info: The group list to impose
130 *
131 * Validate a group subscription and, if valid, impose it upon current's task
132 * security record.
133 */
134 int set_current_groups(struct group_info *group_info)
135 {
136 struct cred *new;
137 struct cred *old;
138
139 new = prepare_creds();
140 if (!new)
141 return -ENOMEM;
142
> 143 old = current_cred();
144
145 set_groups(new, group_info);
146
> 147 retval = security_task_fix_setgroups(new, old);
148 if (retval < 0)
149 goto error;
150
151 return commit_creds(new);
152
153 error:
154 abort_creds(new);
155 return retval;
156 }
157
Hi Micah,
I love your patch! Yet something to improve:
[auto build test ERROR on linus/master]
[also build test ERROR on jmorris-security/next-testing kees/for-next/pstore v5.19-rc2 next-20220614]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch]
url: https://github.com/intel-lab-lkp/linux/commits/Micah-Morton/security-Add-LSM-hook-to-setgroups-syscall/20220614-050341
base: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git b13baccc3850ca8b8cccbf8ed9912dbaa0fdf7f3
config: x86_64-randconfig-a002-20220613 (https://download.01.org/0day-ci/archive/20220614/202206141619.gvenMkdS-lkp@intel.com/config)
compiler: clang version 15.0.0 (https://github.com/llvm/llvm-project c97436f8b6e2718286e8496faf53a2c800e281cf)
reproduce (this is a W=1 build):
wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross
chmod +x ~/bin/make.cross
# https://github.com/intel-lab-lkp/linux/commit/b21cba6f759a2a60439de4d0f85323ed745b3ade
git remote add linux-review https://github.com/intel-lab-lkp/linux
git fetch --no-tags linux-review Micah-Morton/security-Add-LSM-hook-to-setgroups-syscall/20220614-050341
git checkout b21cba6f759a2a60439de4d0f85323ed745b3ade
# save the config file
mkdir build_dir && cp config build_dir/.config
COMPILER_INSTALL_PATH=$HOME/0day COMPILER=clang make.cross W=1 O=build_dir ARCH=x86_64 SHELL=/bin/bash
If you fix the issue, kindly add following tag where applicable
Reported-by: kernel test robot <lkp@intel.com>
All errors (new ones prefixed by >>):
>> kernel/groups.c:143:6: error: assigning to 'struct cred *' from 'typeof (*(get_current()->cred)) *' (aka 'const struct cred *') discards qualifiers [-Werror,-Wincompatible-pointer-types-discards-qualifiers]
old = current_cred();
^ ~~~~~~~~~~~~~~
>> kernel/groups.c:147:2: error: use of undeclared identifier 'retval'
retval = security_task_fix_setgroups(new, old);
^
kernel/groups.c:148:6: error: use of undeclared identifier 'retval'
if (retval < 0)
^
kernel/groups.c:155:9: error: use of undeclared identifier 'retval'
return retval;
^
4 errors generated.
vim +143 kernel/groups.c
126
127 /**
128 * set_current_groups - Change current's group subscription
129 * @group_info: The group list to impose
130 *
131 * Validate a group subscription and, if valid, impose it upon current's task
132 * security record.
133 */
134 int set_current_groups(struct group_info *group_info)
135 {
136 struct cred *new;
137 struct cred *old;
138
139 new = prepare_creds();
140 if (!new)
141 return -ENOMEM;
142
> 143 old = current_cred();
144
145 set_groups(new, group_info);
146
> 147 retval = security_task_fix_setgroups(new, old);
148 if (retval < 0)
149 goto error;
150
151 return commit_creds(new);
152
153 error:
154 abort_creds(new);
155 return retval;
156 }
157
On Tue, 14 Jun 2022, kernel test robot wrote: > Hi Micah, > > I love your patch! Yet something to improve: > > [auto build test ERROR on linus/master] > [also build test ERROR on jmorris-security/next-testing kees/for-next/pstore v5.19-rc2 next-20220614] My next-testing is out of date, I'll push a newer version.
diff --git a/include/linux/lsm_hook_defs.h b/include/linux/lsm_hook_defs.h index db924fe379c9..c01063ec4be7 100644 --- a/include/linux/lsm_hook_defs.h +++ b/include/linux/lsm_hook_defs.h @@ -201,6 +201,7 @@ LSM_HOOK(int, 0, task_fix_setuid, struct cred *new, const struct cred *old, int flags) LSM_HOOK(int, 0, task_fix_setgid, struct cred *new, const struct cred * old, int flags) +LSM_HOOK(int, 0, task_fix_setgroups, struct cred *new, const struct cred * old) LSM_HOOK(int, 0, task_setpgid, struct task_struct *p, pid_t pgid) LSM_HOOK(int, 0, task_getpgid, struct task_struct *p) LSM_HOOK(int, 0, task_getsid, struct task_struct *p) diff --git a/include/linux/lsm_hooks.h b/include/linux/lsm_hooks.h index 419b5febc3ca..b5143d9a1127 100644 --- a/include/linux/lsm_hooks.h +++ b/include/linux/lsm_hooks.h @@ -701,6 +701,13 @@ * @old is the set of credentials that are being replaced. * @flags contains one of the LSM_SETID_* values. * Return 0 on success. + * @task_fix_setgroups: + * Update the module's state after setting the supplementary group + * identity attributes of the current process. + * @new is the set of credentials that will be installed. Modifications + * should be made to this rather than to @current->cred. + * @old is the set of credentials that are being replaced. + * Return 0 on success. * @task_setpgid: * Check permission before setting the process group identifier of the * process @p to @pgid. diff --git a/include/linux/security.h b/include/linux/security.h index 25b3ef71f495..d111ff830742 100644 --- a/include/linux/security.h +++ b/include/linux/security.h @@ -413,6 +413,7 @@ int security_task_fix_setuid(struct cred *new, const struct cred *old, int flags); int security_task_fix_setgid(struct cred *new, const struct cred *old, int flags); +int security_task_fix_setgroups(struct cred *new, const struct cred *old); int security_task_setpgid(struct task_struct *p, pid_t pgid); int security_task_getpgid(struct task_struct *p); int security_task_getsid(struct task_struct *p); @@ -1096,6 +1097,12 @@ static inline int security_task_fix_setgid(struct cred *new, return 0; } +static inline int security_task_fix_setgroups(struct cred *new, + const struct cred *old) +{ + return 0; +} + static inline int security_task_setpgid(struct task_struct *p, pid_t pgid) { return 0; diff --git a/kernel/groups.c b/kernel/groups.c index 787b381c7c00..c085f54d8dbb 100644 --- a/kernel/groups.c +++ b/kernel/groups.c @@ -134,13 +134,25 @@ EXPORT_SYMBOL(set_groups); int set_current_groups(struct group_info *group_info) { struct cred *new; + struct cred *old; new = prepare_creds(); if (!new) return -ENOMEM; + old = current_cred(); + set_groups(new, group_info); + + retval = security_task_fix_setgroups(new, old); + if (retval < 0) + goto error; + return commit_creds(new); + +error: + abort_creds(new); + return retval; } EXPORT_SYMBOL(set_current_groups); diff --git a/security/security.c b/security/security.c index b7cf5cbfdc67..eaed8d16d90a 100644 --- a/security/security.c +++ b/security/security.c @@ -1809,6 +1809,11 @@ int security_task_fix_setgid(struct cred *new, const struct cred *old, return call_int_hook(task_fix_setgid, 0, new, old, flags); } +int security_task_fix_setgroups(struct cred *new, const struct cred *old) +{ + return call_int_hook(task_fix_setgroups, 0, new, old); +} + int security_task_setpgid(struct task_struct *p, pid_t pgid) { return call_int_hook(task_setpgid, 0, p, pgid);
Give the LSM framework the ability to filter setgroups() syscalls. There are already analagous hooks for the set*uid() and set*gid() syscalls. The SafeSetID LSM will use this new hook to ensure setgroups() calls are allowed by the installed security policy. Signed-off-by: Micah Morton <mortonm@chromium.org> --- Developed on 5.18 include/linux/lsm_hook_defs.h | 1 + include/linux/lsm_hooks.h | 7 +++++++ include/linux/security.h | 7 +++++++ kernel/groups.c | 12 ++++++++++++ security/security.c | 5 +++++ 5 files changed, 32 insertions(+)