Techwizz/kernel-fxtec-pro1x
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

groups: Consolidate the setgroups permission checks

Browse source 
Today there are 3 instances of setgroups and due to an oversight their
permission checking has diverged.  Add a common function so that
they may all share the same permission checking code.

This corrects the current oversight in the current permission checks
and adds a helper to avoid this in the future.

A user namespace security fix will update this new helper, shortly.

Cc: stable@vger.kernel.org
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
This commit is contained in:
Eric W. Biederman 2014-12-05 17:19:27 -06:00
parent 4fed655c41
commit 7ff4d90b4c
4 changed files with 11 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
arch/s390/kernel/compat_linux.c
View file

@ -249,7 +249,7 @@ COMPAT_SYSCALL_DEFINE2(s390_setgroups16, int, gidsetsize, u16 __user *, grouplis
struct group_info *group_info; struct group_info *group_info;
int retval; int retval;
if (!capable(CAP_SETGID)) if (!may_setgroups())
return -EPERM; return -EPERM;
if ((unsigned)gidsetsize > NGROUPS_MAX) if ((unsigned)gidsetsize > NGROUPS_MAX)
return -EINVAL; return -EINVAL;

1
include/linux/cred.h
View file

@ -68,6 +68,7 @@ extern void groups_free(struct group_info *);
extern int set_current_groups(struct group_info *); extern int set_current_groups(struct group_info *);
extern void set_groups(struct cred *, struct group_info *); extern void set_groups(struct cred *, struct group_info *);
extern int groups_search(const struct group_info *, kgid_t); extern int groups_search(const struct group_info *, kgid_t);
extern bool may_setgroups(void);
/* access the groups "array" with this macro */ /* access the groups "array" with this macro */
#define GROUP_AT(gi, i) \ #define GROUP_AT(gi, i) \

9
kernel/groups.c
View file

@ -213,6 +213,13 @@ SYSCALL_DEFINE2(getgroups, int, gidsetsize, gid_t __user *, grouplist)
return i; return i;
} }
bool may_setgroups(void)
{
struct user_namespace *user_ns = current_user_ns();
return ns_capable(user_ns, CAP_SETGID);
}
/* /*
* SMP: Our groups are copy-on-write. We can set them safely * SMP: Our groups are copy-on-write. We can set them safely
* without another task interfering. * without another task interfering.
@ -223,7 +230,7 @@ SYSCALL_DEFINE2(setgroups, int, gidsetsize, gid_t __user *, grouplist)
struct group_info *group_info; struct group_info *group_info;
int retval; int retval;
if (!ns_capable(current_user_ns(), CAP_SETGID)) if (!may_setgroups())
return -EPERM; return -EPERM;
if ((unsigned)gidsetsize > NGROUPS_MAX) if ((unsigned)gidsetsize > NGROUPS_MAX)
return -EINVAL; return -EINVAL;

2
kernel/uid16.c
View file

@ -176,7 +176,7 @@ SYSCALL_DEFINE2(setgroups16, int, gidsetsize, old_gid_t __user *, grouplist)
struct group_info *group_info; struct group_info *group_info;
int retval; int retval;
if (!ns_capable(current_user_ns(), CAP_SETGID)) if (!may_setgroups())
return -EPERM; return -EPERM;
if ((unsigned)gidsetsize > NGROUPS_MAX) if ((unsigned)gidsetsize > NGROUPS_MAX)
return -EINVAL; return -EINVAL;