On Thu, 26 Oct 2017, Matthew Garrett wrote: > The existing BPRM_CHECK functionality in IMA validates against the > credentials of the existing process, not any new credentials that the > child process may transition to. Add an additional CREDS_CHECK target > and refactor IMA to pass the appropriate creds structure. In > ima_bprm_check(), check with both the existing process credentials and > the credentials that will be committed when the new process is started. > This will not change behaviour unless the system policy is extended to > include CREDS_CHECK targets - BPRM_CHECK will continue to check the same > credentials that it did previously. > > Signed-off-by: Matthew Garrett <mjg59@xxxxxxxxxx> Reviewed-by: James Morris <james.l.morris@xxxxxxxxxx> -- James Morris <james.l.morris@xxxxxxxxxx>
