| Message ID | 1226430769.3353.5.camel@localhost.localdomain |
|---|---|
| State | Not Applicable, archived |
| Headers | show |
在 2008-11-11二的 14:12 -0500，Eric Paris写道： > ext[2,3,4], ufs, and ubifs all check for CAP_SYS_RESOURCE to determine > if they should allow reserved blocks to be used. A process not having > this capability is not failing some security decision and should not be > audited. Thus move to using has_capability_noaudit. > Looks fine to me. Eric Sandeen has mentioned earlier about the security audit issue with ext4. We fixed it in ext4, with this it is even better. Reviewed-by: Mingming Cao <cmm@us.ibm.com> > Signed-off-by: Eric Paris <eparis@redhat.com> > --- > > I would like to push this patch through the security tree (since that's > the only place the new cap_noaudit interface exists), but I'd like to > get an ACK from each subsystem maintainer. > > fs/ext2/balloc.c | 2 +- > fs/ext3/balloc.c | 2 +- > fs/ext4/balloc.c | 2 +- > fs/ubifs/budget.c | 3 ++- > fs/ufs/balloc.c | 2 +- > security/commoncap.c | 1 + > security/security.c | 1 + > 7 files changed, 8 insertions(+), 5 deletions(-) > > > diff --git a/fs/ext2/balloc.c b/fs/ext2/balloc.c > index 6dac7ba..e06d96d 100644 > --- a/fs/ext2/balloc.c > +++ b/fs/ext2/balloc.c > @@ -1192,7 +1192,7 @@ static int ext2_has_free_blocks(struct ext2_sb_info *sbi) > > free_blocks = percpu_counter_read_positive(&sbi->s_freeblocks_counter); > root_blocks = le32_to_cpu(sbi->s_es->s_r_blocks_count); > - if (free_blocks < root_blocks + 1 && !capable(CAP_SYS_RESOURCE) && > + if (free_blocks < root_blocks + 1 && !has_capability_noaudit(current, CAP_SYS_RESOURCE) && > sbi->s_resuid != current->fsuid && > (sbi->s_resgid == 0 || !in_group_p (sbi->s_resgid))) { > return 0; > diff --git a/fs/ext3/balloc.c b/fs/ext3/balloc.c > index f5b57a2..f224ee4 100644 > --- a/fs/ext3/balloc.c > +++ b/fs/ext3/balloc.c > @@ -1421,7 +1421,7 @@ static int ext3_has_free_blocks(struct ext3_sb_info *sbi) > > free_blocks = percpu_counter_read_positive(&sbi->s_freeblocks_counter); > root_blocks = le32_to_cpu(sbi->s_es->s_r_blocks_count); > - if (free_blocks < root_blocks + 1 && !capable(CAP_SYS_RESOURCE) && > + if (free_blocks < root_blocks + 1 && !has_capability_noaudit(current, CAP_SYS_RESOURCE) && > sbi->s_resuid != current->fsuid && > (sbi->s_resgid == 0 || !in_group_p (sbi->s_resgid))) { > return 0; > diff --git a/fs/ext4/balloc.c b/fs/ext4/balloc.c > index d2003cd..a7c7c52 100644 > --- a/fs/ext4/balloc.c > +++ b/fs/ext4/balloc.c > @@ -626,7 +626,7 @@ int ext4_has_free_blocks(struct ext4_sb_info *sbi, s64 nblocks) > /* Hm, nope. Are (enough) root reserved blocks available? */ > if (sbi->s_resuid == current->fsuid || > ((sbi->s_resgid != 0) && in_group_p(sbi->s_resgid)) || > - capable(CAP_SYS_RESOURCE)) { > + has_capability_noaudit(current, CAP_SYS_RESOURCE)) { > if (free_blocks >= (nblocks + dirty_blocks)) > return 1; > } > diff --git a/fs/ubifs/budget.c b/fs/ubifs/budget.c > index 1a4973e..d17b8b4 100644 > --- a/fs/ubifs/budget.c > +++ b/fs/ubifs/budget.c > @@ -32,6 +32,7 @@ > > #include "ubifs.h" > #include <linux/writeback.h> > +#include <linux/capability.h> > #include <asm/div64.h> > > /* > @@ -363,7 +364,7 @@ long long ubifs_calc_available(const struct ubifs_info *c, int min_idx_lebs) > */ > static int can_use_rp(struct ubifs_info *c) > { > - if (current->fsuid == c->rp_uid || capable(CAP_SYS_RESOURCE) || > + if (current->fsuid == c->rp_uid || has_capability_noaudit(current, CAP_SYS_RESOURCE) || > (c->rp_gid != 0 && in_group_p(c->rp_gid))) > return 1; > return 0; > diff --git a/fs/ufs/balloc.c b/fs/ufs/balloc.c > index 0d9ada1..ad4398b 100644 > --- a/fs/ufs/balloc.c > +++ b/fs/ufs/balloc.c > @@ -411,7 +411,7 @@ u64 ufs_new_fragments(struct inode *inode, void *p, u64 fragment, > /* > * There is not enough space for user on the device > */ > - if (!capable(CAP_SYS_RESOURCE) && ufs_freespace(uspi, UFS_MINFREE) <= 0) { > + if (!has_capability_noaudit(current, CAP_SYS_RESOURCE) && ufs_freespace(uspi, UFS_MINFREE) <= 0) { > unlock_super (sb); > UFSD("EXIT (FAILED)\n"); > return 0; > diff --git a/security/commoncap.c b/security/commoncap.c > index 73999f6..5401e77 100644 > --- a/security/commoncap.c > +++ b/security/commoncap.c > @@ -55,6 +55,7 @@ int cap_capable(struct task_struct *tsk, int cap, int audit) > return 0; > return -EPERM; > } > +EXPORT_SYMBOL(cap_capable); > > int cap_settime(struct timespec *ts, struct timezone *tz) > { > diff --git a/security/security.c b/security/security.c > index 346f21e..d061eb1 100644 > --- a/security/security.c > +++ b/security/security.c > @@ -170,6 +170,7 @@ int security_capable_noaudit(struct task_struct *tsk, int cap) > { > return security_ops->capable(tsk, cap, SECURITY_CAP_NOAUDIT); > } > +EXPORT_SYMBOL(security_capable_noaudit); > > int security_acct(struct file *file) > { > > > -- > To unsubscribe from this list: send the line "unsubscribe linux-ext4" in > the body of a message to majordomo@vger.kernel.org > More majordomo info at http://vger.kernel.org/majordomo-info.html -- To unsubscribe from this list: send the line "unsubscribe linux-ext4" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
On Tue, 11 Nov 2008 14:12:49 -0500 Eric Paris <eparis@redhat.com> wrote: > ext[2,3,4], ufs, and ubifs all check for CAP_SYS_RESOURCE to determine > if they should allow reserved blocks to be used. A process not having > this capability is not failing some security decision and should not be > audited. Thus move to using has_capability_noaudit. > > Signed-off-by: Eric Paris <eparis@redhat.com> > --- > > I would like to push this patch through the security tree (since that's > the only place the new cap_noaudit interface exists), but I'd like to > get an ACK from each subsystem maintainer. OK by me. Whoever added has_capability_noaudit() forgot to document it, so the difference between has_capability_noaudit() and has_capability() eludes this reader. -- To unsubscribe from this list: send the line "unsubscribe linux-ext4" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
On Thu, Nov 13, 2008 at 02:53:16PM -0800, Andrew Morton wrote: > On Tue, 11 Nov 2008 14:12:49 -0500 > Eric Paris <eparis@redhat.com> wrote: > > > ext[2,3,4], ufs, and ubifs all check for CAP_SYS_RESOURCE to determine > > if they should allow reserved blocks to be used. A process not having > > this capability is not failing some security decision and should not be > > audited. Thus move to using has_capability_noaudit. > > > > Signed-off-by: Eric Paris <eparis@redhat.com> > > --- > > > > I would like to push this patch through the security tree (since that's > > the only place the new cap_noaudit interface exists), but I'd like to > > get an ACK from each subsystem maintainer. For ext4: Acked-by: "Theodore Ts'o" <tytso@mit.edu> - Ted -- To unsubscribe from this list: send the line "unsubscribe linux-ext4" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Eric Paris wrote: > ext[2,3,4], ufs, and ubifs all check for CAP_SYS_RESOURCE to determine > if they should allow reserved blocks to be used. A process not having > this capability is not failing some security decision and should not be > audited. Thus move to using has_capability_noaudit. > > Signed-off-by: Eric Paris <eparis@redhat.com> > --- UBIFS part looks OK, as long as the whole idea of the patch is right, which I have not checked, but assume it is. The only question is are you sure exporting 'cap_capable()' is relevant to this patch? You do not seem to call it directly.
On Fri, 2008-11-14 at 09:55 +0200, Artem Bityutskiy wrote: > Eric Paris wrote: > > ext[2,3,4], ufs, and ubifs all check for CAP_SYS_RESOURCE to determine > > if they should allow reserved blocks to be used. A process not having > > this capability is not failing some security decision and should not be > > audited. Thus move to using has_capability_noaudit. > > > > Signed-off-by: Eric Paris <eparis@redhat.com> > > --- > > UBIFS part looks OK, as long as the whole idea of the patch is right, which > I have not checked, but assume it is. > > The only question is are you sure exporting 'cap_capable()' is relevant > to this patch? You do not seem to call it directly. After this change, modules call has_capability_noaudit() which is a #define which turns this into modules calling security_capable_noaudit(). You noticed this and decided it was correct to make that export. But when CONFIG_SECURITY is not set security_capable_notaudit() is a static inline which calls cap_capable(). See include/linux/security.h line 2832 in the linux-next tree. Now modules are calling cap_capable directly, thus the export. -Eric -- To unsubscribe from this list: send the line "unsubscribe linux-ext4" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/fs/ext2/balloc.c b/fs/ext2/balloc.c index 6dac7ba..e06d96d 100644 --- a/fs/ext2/balloc.c +++ b/fs/ext2/balloc.c @@ -1192,7 +1192,7 @@ static int ext2_has_free_blocks(struct ext2_sb_info *sbi) free_blocks = percpu_counter_read_positive(&sbi->s_freeblocks_counter); root_blocks = le32_to_cpu(sbi->s_es->s_r_blocks_count); - if (free_blocks < root_blocks + 1 && !capable(CAP_SYS_RESOURCE) && + if (free_blocks < root_blocks + 1 && !has_capability_noaudit(current, CAP_SYS_RESOURCE) && sbi->s_resuid != current->fsuid && (sbi->s_resgid == 0 || !in_group_p (sbi->s_resgid))) { return 0; diff --git a/fs/ext3/balloc.c b/fs/ext3/balloc.c index f5b57a2..f224ee4 100644 --- a/fs/ext3/balloc.c +++ b/fs/ext3/balloc.c @@ -1421,7 +1421,7 @@ static int ext3_has_free_blocks(struct ext3_sb_info *sbi) free_blocks = percpu_counter_read_positive(&sbi->s_freeblocks_counter); root_blocks = le32_to_cpu(sbi->s_es->s_r_blocks_count); - if (free_blocks < root_blocks + 1 && !capable(CAP_SYS_RESOURCE) && + if (free_blocks < root_blocks + 1 && !has_capability_noaudit(current, CAP_SYS_RESOURCE) && sbi->s_resuid != current->fsuid && (sbi->s_resgid == 0 || !in_group_p (sbi->s_resgid))) { return 0; diff --git a/fs/ext4/balloc.c b/fs/ext4/balloc.c index d2003cd..a7c7c52 100644 --- a/fs/ext4/balloc.c +++ b/fs/ext4/balloc.c @@ -626,7 +626,7 @@ int ext4_has_free_blocks(struct ext4_sb_info *sbi, s64 nblocks) /* Hm, nope. Are (enough) root reserved blocks available? */ if (sbi->s_resuid == current->fsuid || ((sbi->s_resgid != 0) && in_group_p(sbi->s_resgid)) || - capable(CAP_SYS_RESOURCE)) { + has_capability_noaudit(current, CAP_SYS_RESOURCE)) { if (free_blocks >= (nblocks + dirty_blocks)) return 1; } diff --git a/fs/ubifs/budget.c b/fs/ubifs/budget.c index 1a4973e..d17b8b4 100644 --- a/fs/ubifs/budget.c +++ b/fs/ubifs/budget.c @@ -32,6 +32,7 @@ #include "ubifs.h" #include <linux/writeback.h> +#include <linux/capability.h> #include <asm/div64.h> /* @@ -363,7 +364,7 @@ long long ubifs_calc_available(const struct ubifs_info *c, int min_idx_lebs) */ static int can_use_rp(struct ubifs_info *c) { - if (current->fsuid == c->rp_uid || capable(CAP_SYS_RESOURCE) || + if (current->fsuid == c->rp_uid || has_capability_noaudit(current, CAP_SYS_RESOURCE) || (c->rp_gid != 0 && in_group_p(c->rp_gid))) return 1; return 0; diff --git a/fs/ufs/balloc.c b/fs/ufs/balloc.c index 0d9ada1..ad4398b 100644 --- a/fs/ufs/balloc.c +++ b/fs/ufs/balloc.c @@ -411,7 +411,7 @@ u64 ufs_new_fragments(struct inode *inode, void *p, u64 fragment, /* * There is not enough space for user on the device */ - if (!capable(CAP_SYS_RESOURCE) && ufs_freespace(uspi, UFS_MINFREE) <= 0) { + if (!has_capability_noaudit(current, CAP_SYS_RESOURCE) && ufs_freespace(uspi, UFS_MINFREE) <= 0) { unlock_super (sb); UFSD("EXIT (FAILED)\n"); return 0; diff --git a/security/commoncap.c b/security/commoncap.c index 73999f6..5401e77 100644 --- a/security/commoncap.c +++ b/security/commoncap.c @@ -55,6 +55,7 @@ int cap_capable(struct task_struct *tsk, int cap, int audit) return 0; return -EPERM; } +EXPORT_SYMBOL(cap_capable); int cap_settime(struct timespec *ts, struct timezone *tz) { diff --git a/security/security.c b/security/security.c index 346f21e..d061eb1 100644 --- a/security/security.c +++ b/security/security.c @@ -170,6 +170,7 @@ int security_capable_noaudit(struct task_struct *tsk, int cap) { return security_ops->capable(tsk, cap, SECURITY_CAP_NOAUDIT); } +EXPORT_SYMBOL(security_capable_noaudit); int security_acct(struct file *file) {
ext[2,3,4], ufs, and ubifs all check for CAP_SYS_RESOURCE to determine if they should allow reserved blocks to be used. A process not having this capability is not failing some security decision and should not be audited. Thus move to using has_capability_noaudit. Signed-off-by: Eric Paris <eparis@redhat.com> --- I would like to push this patch through the security tree (since that's the only place the new cap_noaudit interface exists), but I'd like to get an ACK from each subsystem maintainer. fs/ext2/balloc.c | 2 +- fs/ext3/balloc.c | 2 +- fs/ext4/balloc.c | 2 +- fs/ubifs/budget.c | 3 ++- fs/ufs/balloc.c | 2 +- security/commoncap.c | 1 + security/security.c | 1 + 7 files changed, 8 insertions(+), 5 deletions(-) -- To unsubscribe from this list: send the line "unsubscribe linux-ext4" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html