linux-kernel - [GIT PULL] SafeSetID changes for v6.0

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAJ-EccPH46FGKQj8gYEg5HGpmmRiqzrZouTZauwpvX-+2j4GNA@mail.gmail.com>
Date:   Mon, 1 Aug 2022 19:42:26 -0700
From:   Micah Morton <mortonm@...omium.org>
To:     Linus Torvalds <torvalds@...ux-foundation.org>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        linux-security-module <linux-security-module@...r.kernel.org>
Subject: [GIT PULL] SafeSetID changes for v6.0

The following changes since commit 32346491ddf24599decca06190ebca03ff9de7f8:


  Linux 5.19-rc6 (2022-07-10 14:40:51 -0700)


are available in the Git repository at:


  https://github.com/micah-morton/linux.git tags/safesetid-6.0


for you to fetch changes up to 64b634830c919979de4b18163e15d30df66e64a8:


  LSM: SafeSetID: add setgroups() testing to selftest (2022-07-15
18:24:42 +0000)


----------------------------------------------------------------

This pull request contains one commit that touches common kernel code,

one that adds functionality internal to the SafeSetID LSM code, and a

few other commits that only modify the SafeSetID LSM selftest.


The commit that touches common kernel code simply adds an LSM hook in

the setgroups() syscall that mirrors what is done for the existing LSM

hooks in the setuid() and setgid() syscalls. This commit combined with

the SafeSetID-specific one allow the LSM to filter setgroups() calls

according to configured rule sets in the same way that is already done

for setuid() and setgid().


The changes are based on v5.19-rc6 and have been in -next.


----------------------------------------------------------------

Micah Morton (6):

      LSM: SafeSetID: fix userns bug in selftest

      LSM: SafeSetID: selftest cleanup and prepare for GIDs

      LSM: SafeSetID: add GID testing to selftest

      security: Add LSM hook to setgroups() syscall

      LSM: SafeSetID: Add setgroups() security policy handling

      LSM: SafeSetID: add setgroups() testing to selftest


 include/linux/lsm_hook_defs.h                      |   1 +

 include/linux/lsm_hooks.h                          |   7 +

 include/linux/security.h                           |   7 +

 kernel/groups.c                                    |  13 +

 security/safesetid/lsm.c                           |  39 ++-

 security/security.c                                |   5 +

 tools/testing/selftests/safesetid/Makefile         |   2 +-

 tools/testing/selftests/safesetid/safesetid-test.c | 295 ++++++++++++++++++---

 8 files changed, 315 insertions(+), 54 deletions(-)