Re: [PATCH] exec: Check __FMODE_EXEC instead of in_execve for LSMs

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

To: Kees Cook <keescook@xxxxxxxxxxxx>, Jann Horn <jannh@xxxxxxxxxx>
Subject: Re: [PATCH] exec: Check __FMODE_EXEC instead of in_execve for LSMs
From: Tetsuo Handa <penguin-kernel@xxxxxxxxxxxxxxxxxxx>
Date: Thu, 25 Jan 2024 23:34:00 +0900
Cc: Linus Torvalds <torvalds@xxxxxxxxxxxxxxxxxxxx>, Josh Triplett <josh@xxxxxxxxxxxxxxxx>, Kevin Locke <kevin@xxxxxxxxxxxxxxx>, John Johansen <john.johansen@xxxxxxxxxxxxx>, Paul Moore <paul@xxxxxxxxxxxxxx>, James Morris <jmorris@xxxxxxxxx>, "Serge E. Hallyn" <serge@xxxxxxxxxx>, Kentaro Takeda <takedakn@xxxxxxxxxxxxx>, Alexander Viro <viro@xxxxxxxxxxxxxxxxxx>, Christian Brauner <brauner@xxxxxxxxxx>, Jan Kara <jack@xxxxxxx>, Eric Biederman <ebiederm@xxxxxxxxxxxx>, Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>, Sebastian Andrzej Siewior <bigeasy@xxxxxxxxxxxxx>, linux-fsdevel@xxxxxxxxxxxxxxx, linux-mm@xxxxxxxxx, apparmor@xxxxxxxxxxxxxxxx, linux-security-module@xxxxxxxxxxxxxxx, linux-kernel@xxxxxxxxxxxxxxx, linux-hardening@xxxxxxxxxxxxxxx
In-reply-to: <202401241348.1A2860EB58@keescook>
User-agent: Mozilla Thunderbird

On 2024/01/25 6:50, Kees Cook wrote:
> Yeah, I was just noticing this. I was over thinking. :) It does look
> like all that is needed is to remove __FMODE_EXEC.

I worry that some out-of-tree kernel code continues using __FMODE_EXEC for
opening for non-execve() purpose. If that happened, TOMOYO will be fooled...
Can't we remove __FMODE_EXEC and FMODE_EXEC flag from f_flags instead of
replacing current->in_execve with file->f_flags & __FMODE_EXEC ?

Follow-Ups:
- Re: [PATCH] exec: Check __FMODE_EXEC instead of in_execve for LSMs
  - From: Jann Horn

References:
- [PATCH] exec: Check __FMODE_EXEC instead of in_execve for LSMs
  - From: Kees Cook
- Re: [PATCH] exec: Check __FMODE_EXEC instead of in_execve for LSMs
  - From: Jann Horn
- Re: [PATCH] exec: Check __FMODE_EXEC instead of in_execve for LSMs
  - From: Kees Cook
- Re: [PATCH] exec: Check __FMODE_EXEC instead of in_execve for LSMs
  - From: Linus Torvalds
- Re: [PATCH] exec: Check __FMODE_EXEC instead of in_execve for LSMs
  - From: Kees Cook
- Re: [PATCH] exec: Check __FMODE_EXEC instead of in_execve for LSMs
  - From: Jann Horn
- Re: [PATCH] exec: Check __FMODE_EXEC instead of in_execve for LSMs
  - From: Kees Cook

Prev by Date: Re: [6.8-rc1 Regression] Unable to exec apparmor_parser from virt-aa-helper
Next by Date: Re: [PATCH] exec: Check __FMODE_EXEC instead of in_execve for LSMs
Previous by thread: Re: [PATCH] exec: Check __FMODE_EXEC instead of in_execve for LSMs
Next by thread: Re: [PATCH] exec: Check __FMODE_EXEC instead of in_execve for LSMs
Index(es):
- Date
- Thread

[Index of Archives] [Linux Ext4 Filesystem] [Union Filesystem] [Filesystem Testing] [Ceph Users] [Ecryptfs] [NTFS 3] [AutoFS] [Kernel Newbies] [Share Photos] [Security] [Netfilter] [Bugtraq] [Yosemite News] [MIPS Linux] [ARM Linux] [Linux Security] [Linux Cachefs] [Reiser Filesystem] [Linux RAID] [NTFS 3] [Samba] [Device Mapper] [CEPH Development]