Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1729390

Re: [PATCH] usb,signal,security: only pass the cred, not the secid, to kill_pid_info_as_cred and security_task_kill

Show all headers | View raw

On Fri, Sep 08, 2017 at 12:40:01PM -0400, Stephen Smalley wrote:
> commit d178bc3a708f39cbfefc3fab37032d3f2511b4ec ("user namespace: usb:
>  make usb urbs user namespace aware (v2)") changed kill_pid_info_as_uid
> to kill_pid_info_as_cred, saving and passing a cred structure instead of
> uids.  Since the secid can be obtained from the cred, drop the secid fields
> from the usb_dev_state and async structures, and drop the secid argument to
> kill_pid_info_as_cred.  Replace the secid argument to security_task_kill
> with the cred.  Update SELinux, Smack, and AppArmor to use the cred, which
> avoids the need for Smack and AppArmor to use a secid at all in this hook.
> Further changes to Smack might still be required to take full advantage of
> this change, since it should now be possible to perform capability
> checking based on the supplied cred.  The changes to Smack and AppArmor
> have only been compile-tested.
> 
> Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
> ---
>  drivers/usb/core/devio.c     | 10 ++--------
>  include/linux/lsm_hooks.h    |  5 +++--
>  include/linux/sched/signal.h |  2 +-
>  include/linux/security.h     |  4 ++--
>  kernel/signal.c              |  6 +++---
>  security/apparmor/lsm.c      | 17 ++++++++++++-----
>  security/security.c          |  4 ++--
>  security/selinux/hooks.c     |  7 +++++--
>  security/smack/smack_lsm.c   | 12 +++++-------
>  9 files changed, 35 insertions(+), 32 deletions(-)


Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH] usb,signal,security: only pass the cred, not the secid, to kill_pid_info_as_cred and security_task_kill Stephen Smalley <sds@tycho.nsa.gov> - 2017-09-08 18:50 +0200
  Re: [PATCH] usb,signal,security: only pass the cred, not the secid,  to kill_pid_info_as_cred and security_task_kill Casey Schaufler <casey@schaufler-ca.com> - 2017-09-08 19:00 +0200
  Re: [PATCH] usb,signal,security: only pass the cred, not the secid,  to kill_pid_info_as_cred and security_task_kill Paul Moore <paul@paul-moore.com> - 2017-09-08 19:20 +0200
    Re: [PATCH] usb,signal,security: only pass the cred, not the secid,  to kill_pid_info_as_cred and security_task_kill James Morris <jmorris@namei.org> - 2017-09-09 00:10 +0200
  Re: [PATCH] usb,signal,security: only pass the cred, not the secid,  to kill_pid_info_as_cred and security_task_kill Casey Schaufler <casey@schaufler-ca.com> - 2017-09-09 00:30 +0200
  Re: [PATCH] usb,signal,security: only pass the cred, not the secid,  to kill_pid_info_as_cred and security_task_kill Greg KH <gregkh@linuxfoundation.org> - 2017-09-09 07:50 +0200
  Re: [Fwd: [PATCH] usb,signal,security: only pass the cred, not the  secid, to kill_pid_info_as_cred and security_task_kill] John Johansen <john.johansen@canonical.com> - 2017-09-09 09:20 +0200

csiph-web