Changes in v3: NULLify private data arg of single_open() calls as suggested by Kees Cook <kees@xxxxxxxxxx> Changes in v2: define set_current_groups() for !CONFIG_MULTIUSER addressing a test robot-reported failure. This patch set implements the PROCFS_SET_GROUPS ioctl that allows to set the group list from the fd referring to /proc/<pid>/status. It consists of 2 patches: a small preparatory patch and an implementation itself. The very detailed explanation of usage, security considerations and implementation details are documented in the commit log of the second patch. Brief summary below. The problem: If you use suid/sgid bits to switch to a less-privileged (home-less) user, then the group list can't be changed, effectively nullifying any supposed restrictions. As such, suid/sgid to non-root creds is currently practically useless. Previous solutions: https://www.spinics.net/lists/kernel/msg5383847.html This solution allows to restrict the groups from group list. It failed to get any attention for probably being too ad-hoc. https://lore.kernel.org/all/0895c1f268bc0b01cc6c8ed4607d7c3953f49728.1416041823.git.josh@xxxxxxxxxxxxxxxx/ This solution from Josh Tripplett was considered insecure. New proposal: Given that /proc/<pid>/status file carries the cred info including the group list, it seems natural to use that file to transfer and apply the group list within. The trusted entity should permit such operation and send the needed group info to client via SCM_RIGHTS. Client can check the received info by reading from fd. If he is satisfied, he can use the new ioctl to try to set the group list from the received status file. Kernel does all the needed security and sanity checks, and either returns an error or applies the group list. For more details and security considerations please refer to the commit message of the second patch. As the result, given that the process did the suid/sgid-assisted switch, it can obtain the correct group info that matches his new credentials. None of the previous proposals allowed to get the right group info: it was either cleared or "restricted" but never correct. This proposal aims to amend all of the previous short-comings with the hope to make the suid/sgid-assisted switches useful for dropping access rights. Usage example: I put the user-space usage example here: https://github.com/stsp/cred_test `tst.sh` script sets the needed permissions and runs server and client. Client does the suid/sgid-assisted identity switch and asks the server for the new group info. Server grants the needed group info based on client's credentials (using SO_PEERCRED) and client executes `id` command to show the result. Signed-off-by: Stas Sergeev <stsp2@xxxxxxxxx> CC: Eric Biederman <ebiederm@xxxxxxxxxxxx> CC: Andy Lutomirski <luto@xxxxxxxxxx> CC: Aleksa Sarai <cyphar@xxxxxxxxxx> CC: Alexander Viro <viro@xxxxxxxxxxxxxxxxxx> CC: Christian Brauner <brauner@xxxxxxxxxx> CC: Jan Kara <jack@xxxxxxx> CC: Thomas Gleixner <tglx@xxxxxxxxxxxxx> CC: Jeff Layton <jlayton@xxxxxxxxxx> CC: John Johansen <john.johansen@xxxxxxxxxxxxx> CC: Chengming Zhou <chengming.zhou@xxxxxxxxx> CC: Casey Schaufler <casey@xxxxxxxxxxxxxxxx> CC: Adrian Ratiu <adrian.ratiu@xxxxxxxxxxxxx> CC: Felix Moessbauer <felix.moessbauer@xxxxxxxxxxx> CC: Jens Axboe <axboe@xxxxxxxxx> CC: Oleg Nesterov <oleg@xxxxxxxxxx> Cc: "Serge E. Hallyn" <serge@xxxxxxxxxx> CC: Kees Cook <kees@xxxxxxxxxx> CC: linux-kernel@xxxxxxxxxxxxxxx CC: linux-fsdevel@xxxxxxxxxxxxxxx Stas Sergeev (2): procfs: avoid some usages of seq_file private data procfs: implement PROCFS_SET_GROUPS ioctl fs/proc/base.c | 148 +++++++++++++++++++++++++++++++++++++--- include/linux/cred.h | 4 ++ include/uapi/linux/fs.h | 2 + 3 files changed, 146 insertions(+), 8 deletions(-) -- 2.47.0
