linux-kernel - Re: [PATCH] ipc: don't audit capability check in ipc

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <aXI2IOmVZTWlYE_9@example.org>
Date: Thu, 22 Jan 2026 15:37:20 +0100
From: Alexey Gladkov <legion@...nel.org>
To: Ondrej Mosnacek <omosnace@...hat.com>
Cc: Andrew Morton <akpm@...ux-foundation.org>,
	"Eric W . Biederman" <ebiederm@...ssion.com>,
	linux-kernel@...r.kernel.org, linux-security-module@...r.kernel.org,
	selinux@...r.kernel.org
Subject: Re: [PATCH] ipc: don't audit capability check in ipc_permissions()

On Thu, Jan 22, 2026 at 03:13:03PM +0100, Ondrej Mosnacek wrote:
> The IPC sysctls implement the ctl_table_root::permissions hook and
> they override the file access mode based on the CAP_CHECKPOINT_RESTORE
> capability, which is being checked regardless of whether any access is
> actually denied or not, so if an LSM denies the capability, an audit
> record may be logged even when access is in fact granted.
> 
> It wouldn't be viable to restructure the sysctl permission logic to only
> check the capability when the access would be actually denied if it's
> not granted. Thus, do the same as in net_ctl_permissions()
> (net/sysctl_net.c) - switch from ns_capable() to ns_capable_noaudit(),
> so that the check never emits an audit record.
> 
> Fixes: 0889f44e2810 ("ipc: Check permissions for checkpoint_restart sysctls at open time")
> Signed-off-by: Ondrej Mosnacek <omosnace@...hat.com>

Some permission hooks already use ns_capable_noaudit.
For example, pid_table_root_permissions.
I think it makes sense here also.

Acked-by: Alexey Gladkov <legion@...nel.org>

> ---
>  include/linux/capability.h | 6 ++++++
>  ipc/ipc_sysctl.c           | 2 +-
>  2 files changed, 7 insertions(+), 1 deletion(-)
> 
> diff --git a/include/linux/capability.h b/include/linux/capability.h
> index 1fb08922552c7..37db92b3d6f89 100644
> --- a/include/linux/capability.h
> +++ b/include/linux/capability.h
> @@ -203,6 +203,12 @@ static inline bool checkpoint_restore_ns_capable(struct user_namespace *ns)
>  		ns_capable(ns, CAP_SYS_ADMIN);
>  }
>  
> +static inline bool checkpoint_restore_ns_capable_noaudit(struct user_namespace *ns)
> +{
> +	return ns_capable_noaudit(ns, CAP_CHECKPOINT_RESTORE) ||
> +		ns_capable_noaudit(ns, CAP_SYS_ADMIN);
> +}
> +
>  /* audit system wants to get cap info from files as well */
>  int get_vfs_caps_from_disk(struct mnt_idmap *idmap,
>  			   const struct dentry *dentry,
> diff --git a/ipc/ipc_sysctl.c b/ipc/ipc_sysctl.c
> index 15b17e86e198c..9b087ebeb643b 100644
> --- a/ipc/ipc_sysctl.c
> +++ b/ipc/ipc_sysctl.c
> @@ -214,7 +214,7 @@ static int ipc_permissions(struct ctl_table_header *head, const struct ctl_table
>  	if (((table->data == &ns->ids[IPC_SEM_IDS].next_id) ||
>  	     (table->data == &ns->ids[IPC_MSG_IDS].next_id) ||
>  	     (table->data == &ns->ids[IPC_SHM_IDS].next_id)) &&
> -	    checkpoint_restore_ns_capable(ns->user_ns))
> +	    checkpoint_restore_ns_capable_noaudit(ns->user_ns))
>  		mode = 0666;
>  	else
>  #endif
> -- 
> 2.52.0
> 

-- 
Rgrds, legion