linux-kernel - Re: [PATCH] block: Check ADMIN before NICE for IOPRIO_CLASS

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Tue, 16 Nov 2021 07:36:28 -0600
From:   "Serge E. Hallyn" <serge@...lyn.com>
To:     David Laight <David.Laight@...LAB.COM>
Cc:     'Alistair Delva' <adelva@...gle.com>,
        Ondrej Mosnacek <omosnace@...hat.com>,
        Linux kernel mailing list <linux-kernel@...r.kernel.org>,
        Khazhismel Kumykov <khazhy@...gle.com>,
        Bart Van Assche <bvanassche@....org>,
        Serge Hallyn <serge@...lyn.com>, Jens Axboe <axboe@...nel.dk>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        Paul Moore <paul@...l-moore.com>,
        SElinux list <selinux@...r.kernel.org>,
        Linux Security Module list 
        <linux-security-module@...r.kernel.org>,
        "Cc: Android Kernel" <kernel-team@...roid.com>,
        Linux Stable maillist <stable@...r.kernel.org>,
        john.johansen@...onical.com, James Morris <jmorris@...ei.org>,
        Christian Brauner <christian@...uner.io>,
        Tycho Andersen <tycho@...ho.ws>
Subject: Re: [PATCH] block: Check ADMIN before NICE for IOPRIO_CLASS_RT

On Tue, Nov 16, 2021 at 09:30:12AM +0000, David Laight wrote:
> From: Alistair Delva
> > Sent: 15 November 2021 19:09
> ...
> > > > -                       if (!capable(CAP_SYS_NICE) && !capable(CAP_SYS_ADMIN))
> > > > +                       if (!capable(CAP_SYS_ADMIN) && !capable(CAP_SYS_NICE))
> > > >                                 return -EPERM;
> 
> Isn't the real problem that you actually want to test:
> 		if (!capable(CAP_SYS_NICE | CAP_SYS_ADMIN))
> 			return -EPERM;
> so that you only get the fail 'splat' when neither is set.
> 
> This will be true whenever more than one capability enables something.
> 
> Possibly this needs something like:
> int capabale_or(unsigned int, ...);
> #define capabale_or(...) capabable_or(__VA_LIST__, ~0u)
> 
> 	David

Right, that's what i was suggesting yesterday.  We do this in other
places, where we split off a more fine-grained version of a gross
capability.  If we care enough about the audit messages, then we
probably do need a new primitive.

-serge