linux-kernel - [PATCH] pid: use ns_capable_noaudit() when determining net sysctl permissions

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20250910192605.16431-1-cgoettsche@seltendoof.de>
Date: Wed, 10 Sep 2025 21:26:05 +0200
From: Christian Göttsche <cgoettsche@...tendoof.de>
To: linux-kernel@...r.kernel.org
Cc: Christian Göttsche <cgzones@...glemail.com>,
	Christian Brauner <brauner@...nel.org>,
	linux-security-module@...r.kernel.org,
	selinux@...r.kernel.org
Subject: [PATCH] pid: use ns_capable_noaudit() when determining net sysctl permissions

From: Christian Göttsche <cgzones@...glemail.com>

The capability check should not be audited since it is only being used
to determine the inode permissions. A failed check does not indicate a
violation of security policy but, when an LSM is enabled, a denial audit
message was being generated.

The denial audit message can either lead to the capability being
unnecessarily allowed in a security policy, or being silenced potentially
masking a legitimate capability check at a later point in time.

Similar to commit d6169b0206db ("net: Use ns_capable_noaudit() when
determining net sysctl permissions")

Fixes: 7863dcc72d0f ("pid: allow pid_max to be set per pid namespace")
CC: Christian Brauner <brauner@...nel.org>
CC: linux-security-module@...r.kernel.org
CC: selinux@...r.kernel.org
Signed-off-by: Christian Göttsche <cgzones@...glemail.com>
---
 kernel/pid.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/pid.c b/kernel/pid.c
index c45a28c16cd2..d94ce0250501 100644
--- a/kernel/pid.c
+++ b/kernel/pid.c
@@ -680,7 +680,7 @@ static int pid_table_root_permissions(struct ctl_table_header *head,
 		container_of(head->set, struct pid_namespace, set);
 	int mode = table->mode;
 
-	if (ns_capable(pidns->user_ns, CAP_SYS_ADMIN) ||
+	if (ns_capable_noaudit(pidns->user_ns, CAP_SYS_ADMIN) ||
 	    uid_eq(current_euid(), make_kuid(pidns->user_ns, 0)))
 		mode = (mode & S_IRWXU) >> 6;
 	else if (in_egroup_p(make_kgid(pidns->user_ns, 0)))
-- 
2.51.0