On Tue, Nov 28, 2017 at 1:35 PM, Mimi Zohar <zohar@xxxxxxxxxxxxxxxxxx> wrote: > On Tue, 2017-11-28 at 13:22 -0800, Matthew Garrett wrote: >> We need to check against the appropriate credentials structure, and >> since we're doing this before commit_creds() has been called we can't >> just do it against the one in the task structure. For BPRM_CHECK >> that'll be current_cred(), which means there's no change in >> functionality, whereas for CREDS_CHECK it'll be the new credentials >> structure. > > The existing code calls security_task_getsecid() with "current" not > "current_cred". Will replacing security_task_getsecid() with > security_cred_getsecid() return the same info for the original > BRPM_CHECK? security_task_getsecid(current) will give the same results as security_cred_getsecid(current_creds())
