GitHub-Mirror/linux-bl808
2
0
Fork 0
mirror of https://github.com/Fishwaldo/linux-bl808.git synced 2025-06-17 20:25:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

security: Add LSM hooks to set*gid syscalls

Browse source 
The SafeSetID LSM uses the security_task_fix_setuid hook to filter
set*uid() syscalls according to its configured security policy. In
preparation for adding analagous support in the LSM for set*gid()
syscalls, we add the requisite hook here. Tested by putting print
statements in the security_task_fix_setgid hook and seeing them get hit
during kernel boot.

Signed-off-by: Thomas Cedeno <thomascedeno@google.com>
Signed-off-by: Micah Morton <mortonm@chromium.org>
This commit is contained in:
Thomas Cedeno 2020-06-09 10:22:13 -07:00 • committed by Micah Morton
parent 3d77e6a880
commit 39030e1351
5 changed files with 40 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

9
include/linux/lsm_hooks.h
View file

@ -651,6 +651,15 @@
* @old is the set of credentials that are being replaces
* @flags contains one of the LSM_SETID_* values.
* Return 0 on success.
* @task_fix_setgid:
* Update the module's state after setting one or more of the group
* identity attributes of the current process. The @flags parameter
* indicates which of the set*gid system calls invoked this hook.
* @new is the set of credentials that will be installed. Modifications
* should be made to this rather than to @current->cred.
* @old is the set of credentials that are being replaced.
* @flags contains one of the LSM_SETID_* values.
* Return 0 on success.
* @task_setpgid:
* Check permission before setting the process group identifier of the
* process @p to @pgid.