linux-kernel - Re: [PATCH -v1 2/3] vm: use new has_capability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <1225307723.6588.119.camel@moss-spartans.epoch.ncsc.mil>
Date:	Wed, 29 Oct 2008 15:15:23 -0400
From:	Stephen Smalley <sds@...ho.nsa.gov>
To:	Eric Paris <eparis@...hat.com>
Cc:	linux-kernel@...r.kernel.org, selinux@...ho.nsa.gov,
	linux-security-module@...r.kernel.org, jmorris@...eil.org,
	serue@...ibm.com, morgan@...nel.org, casey@...aufler-ca.com,
	esandeen@...hat.com
Subject: Re: [PATCH -v1 2/3] vm: use new has_capability_noaudit

On Wed, 2008-10-29 at 15:06 -0400, Eric Paris wrote:
> The oomkiller calculations make decisions based on capabilities.  Since
> these are not security decisions and LSMs should not record if they fall
> the request they should use the new has_capability_noaudit() interface so
> the denials will not be recorded.
> 
> Signed-off-by: Eric Paris <eparis@...hat.com>
> ---
> 
>  fs/proc/base.c |    2 +-
>  mm/oom_kill.c  |    6 +++---
>  2 files changed, 4 insertions(+), 4 deletions(-)
> 
> diff --git a/fs/proc/base.c b/fs/proc/base.c
> index 486cf3f..ef83e81 100644
> --- a/fs/proc/base.c
> +++ b/fs/proc/base.c
> @@ -1020,7 +1020,7 @@ static ssize_t oom_adjust_write(struct file *file, const char __user *buf,
>  	task = get_proc_task(file->f_path.dentry->d_inode);
>  	if (!task)
>  		return -ESRCH;
> -	if (oom_adjust < task->oomkilladj && !capable(CAP_SYS_RESOURCE)) {
> +	if (oom_adjust < task->oomkilladj && !has_capability_noaudit(current, CAP_SYS_RESOURCE)) {

This one looks like an actual permission check to see whether the
current task is authorized to modify this value (by writing to some proc
node).  Which should be audited.  Unlike the others, where they are
checking whether some other task has a capability in order to help
decide priorities for the OOM killer.


>  		put_task_struct(task);
>  		return -EACCES;
>  	}
> diff --git a/mm/oom_kill.c b/mm/oom_kill.c
> index 64e5b4b..34a458a 100644
> --- a/mm/oom_kill.c
> +++ b/mm/oom_kill.c
> @@ -129,8 +129,8 @@ unsigned long badness(struct task_struct *p, unsigned long uptime)
>  	 * Superuser processes are usually more important, so we make it
>  	 * less likely that we kill those.
>  	 */
> -	if (has_capability(p, CAP_SYS_ADMIN) ||
> -	    has_capability(p, CAP_SYS_RESOURCE))
> +	if (has_capability_noaudit(p, CAP_SYS_ADMIN) ||
> +	    has_capability_noaudit(p, CAP_SYS_RESOURCE))
>  		points /= 4;
>  
>  	/*
> @@ -139,7 +139,7 @@ unsigned long badness(struct task_struct *p, unsigned long uptime)
>  	 * tend to only have this flag set on applications they think
>  	 * of as important.
>  	 */
> -	if (has_capability(p, CAP_SYS_RAWIO))
> +	if (has_capability_noaudit(p, CAP_SYS_RAWIO))
>  		points /= 4;
>  
>  	/*
-- 
Stephen Smalley
National Security Agency

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/