Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1683418

Re: [PATCH 0/2] exec: Use sane stack rlimit for setuid exec

Show all headers | View raw

On Fri, Jul 7, 2017 at 1:04 PM, Linus Torvalds
<torvalds@linux-foundation.org> wrote:
>
> It looks like Kees went through the security modules [..]

i take that back. It looks like Kees looked at smack, but not at
SElinux, for example.

selinux_bprm_secureexec() seems to just look at current_security(),
not at the new stuff in bprm at all.

Which would seem to be exactly the wrong thing to do, and is insane
(why pass in bprm at all?) but comes from the fact that we used to
call bprm_secureexec() in an insane place.

So I think this patch series is sadly broken - I think it does the
right thing, but the security modules definitely look like they need
to be updated for that right thing.

                    Linus

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 0/2] exec: Use sane stack rlimit for setuid exec Kees Cook <keescook@chromium.org> - 2017-07-07 22:00 +0200
  Re: [PATCH 0/2] exec: Use sane stack rlimit for setuid exec Linus Torvalds <torvalds@linux-foundation.org> - 2017-07-07 22:10 +0200
    Re: [PATCH 0/2] exec: Use sane stack rlimit for setuid exec Linus Torvalds <torvalds@linux-foundation.org> - 2017-07-07 22:20 +0200
      Re: [PATCH 0/2] exec: Use sane stack rlimit for setuid exec Kees Cook <keescook@chromium.org> - 2017-07-08 00:20 +0200
    Re: [PATCH 0/2] exec: Use sane stack rlimit for setuid exec Kees Cook <keescook@chromium.org> - 2017-07-08 00:20 +0200
      Re: [PATCH 0/2] exec: Use sane stack rlimit for setuid exec Linus Torvalds <torvalds@linux-foundation.org> - 2017-07-08 00:50 +0200
    Re: [PATCH 0/2] exec: Use sane stack rlimit for setuid exec Kees Cook <keescook@chromium.org> - 2017-07-08 06:00 +0200
  Re: [PATCH 0/2] exec: Use sane stack rlimit for setuid exec Andy Lutomirski <luto@kernel.org> - 2017-07-08 00:00 +0200
    Re: [PATCH 0/2] exec: Use sane stack rlimit for setuid exec Kees Cook <keescook@chromium.org> - 2017-07-08 00:20 +0200

csiph-web