Linus Torvalds <torvalds@xxxxxxxxxxxxxxxxxxxx> writes: > On Tue, May 19, 2020 at 11:03 AM Kees Cook <keescook@xxxxxxxxxxxx> wrote: >> >> One question, though: why add this, since the repeat calling of the caps >> LSM hook will do this? > > I assume it's for the "preserve_creds" case where we don't even end up > setting creds at all. > > Yeah, at some point we'll hit a bprm handler that doesn't set > 'preserve_creds', and it all does get set in the end, but that's not > statically all that obvious. > > I think it makes sense to initialize as much as possible from the > generic code, and rely as little as possible on what the binfmt > handlers end up actually doing. Where this initially came from was I was looking at how to clean up the case of no_new_privs/ptrace of a suid executable when we don't have enough permissions. Just being able to create creds that kept everything as they were looked very useful and there was just this one little bit missing. I included the change to prepare_exec_creds in this patchset to emphasize that neither security_bprm_creds_for_exec nor security_bprm_repopulate_creds need to do anything if there is nothing special going on. At the very least that helps me think through what the LSMs are required to do, and what those hooks are for. AKA privilege changing execs. So I was thinking rely on the LSMs as little as possible rather than rely on the binfmt handlers as little as possible. But it is the same idea. And yes it makes everything easier to analyze if everything starts off in a known good state. Eric
