[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <0f8291f7-48b1-4be1-8a57-dbad5d0ab28c@kernel.dk>
Date: Fri, 15 Mar 2024 12:41:41 -0600
From: Jens Axboe <axboe@...nel.dk>
To: Andrii Nakryiko <andrii.nakryiko@...il.com>,
Christian Göttsche <cgzones@...glemail.com>
Cc: linux-security-module@...r.kernel.org, linux-block@...r.kernel.org,
Serge Hallyn <serge@...lyn.com>, linux-kernel@...r.kernel.org,
bpf@...r.kernel.org
Subject: Re: [PATCH 02/10] capability: add any wrappers to test for multiple
caps with exactly one audit message
On 3/15/24 10:45 AM, Andrii Nakryiko wrote:
>> +/**
>> + * ns_capable_any - Determine if the current task has one of two superior capabilities in effect
>> + * @ns: The usernamespace we want the capability in
>> + * @cap1: The capabilities to be tested for first
>> + * @cap2: The capabilities to be tested for secondly
>> + *
>> + * Return true if the current task has at least one of the two given superior
>> + * capabilities currently available for use, false if not.
>> + *
>> + * In contrast to or'ing capable() this call will create exactly one audit
>> + * message, either for @cap1, if it is granted or both are not permitted,
>> + * or @cap2, if it is granted while the other one is not.
>> + *
>> + * The capabilities should be ordered from least to most invasive, i.e. CAP_SYS_ADMIN last.
>> + *
>> + * This sets PF_SUPERPRIV on the task if the capability is available on the
>> + * assumption that it's about to be used.
>> + */
>> +bool ns_capable_any(struct user_namespace *ns, int cap1, int cap2)
>> +{
>> + if (cap1 == cap2)
>> + return ns_capable(ns, cap1);
>> +
>> + if (ns_capable_noauditondeny(ns, cap1))
>> + return true;
>> +
>> + if (ns_capable_noauditondeny(ns, cap2))
>> + return true;
>> +
>> + return ns_capable(ns, cap1);
>
> this will incur an extra capable() check (with all the LSMs involved,
> etc), and so for some cases where capability is expected to not be
> present, this will be a regression. Is there some way to not redo the
> check, but just audit the failure? At this point we do know that cap1
> failed before, so might as well just log that.
Not sure why that's important - if it's a failure case, and any audit
failure should be, then why would we care if that's now doing a bit of
extra work?
I say this not knowing the full picture, as I unhelpfully was only CC'ed
on two of the patches... Please don't do that when sending patchsets.
--
Jens Axboe
Powered by blists - more mailing lists