Re: [PATCH V3 2/2] IMA: Support using new creds in appraisal policy

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Tue, 2017-11-28 at 13:37 -0800, Matthew Garrett wrote:
> On Tue, Nov 28, 2017 at 1:35 PM, Mimi Zohar <zohar@xxxxxxxxxxxxxxxxxx> wrote:
> > On Tue, 2017-11-28 at 13:22 -0800, Matthew Garrett wrote:
> >> We need to check against the appropriate credentials structure, and
> >> since we're doing this before commit_creds() has been called we can't
> >> just do it against the one in the task structure.  For BPRM_CHECK
> >> that'll be current_cred(), which means there's no change in
> >> functionality, whereas for CREDS_CHECK it'll be the new credentials
> >> structure.
> >
> > The existing code calls security_task_getsecid() with "current" not
> > "current_cred".  Will replacing security_task_getsecid() with
> > security_cred_getsecid() return the same info for the original
> > BRPM_CHECK?
> 
> security_task_getsecid(current) will give the same results as
> security_cred_getsecid(current_creds())

Unwinding security_task_getsecid(current) looks like it is using
real_cred, while current_cred() is using cred.

selinux_task_getsecid() -> task_sid() -> cred_sid(__task_cred())

#define __task_cred(task)       \
        rcu_dereference((task)->real_cred)

selinux_task_getsecid() -> cred_sid()

#define current_cred() \
        rcu_dereference_protected(current->cred, 1)

Is the change intentional?

Mimi




[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Linux Kernel]     [Linux Kernel Hardening]     [Linux NFS]     [Linux NILFS]     [Linux USB Devel]     [Video for Linux]     [Linux Audio Users]     [Yosemite News]     [Linux SCSI]

  Powered by Linux