The patch titled
file capabilities: remove cap_task_kill()
has been added to the -mm tree. Its filename is
file-capabilities-remove-cap_task_kill-git.patch
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/SubmitChecklist when testing your code ***
See http://www.zip.com.au/~akpm/linux/patches/stuff/added-to-mm.txt to find
out what to do about this
The current -mm tree may be found at http://userweb.kernel.org/~akpm/mmotm/
------------------------------------------------------
Subject: file capabilities: remove cap_task_kill()
From: "Serge E. Hallyn" <serue@xxxxxxxxxx>
The original justification for cap_task_kill() was as follows:
check_kill_permission() does appropriate uid equivalence checks.
However with file capabilities it becomes possible for an
unprivileged user to execute a file with file capabilities
resulting in a more privileged task with the same uid.
However now that cap_task_kill() always returns 0 (permission granted) when
p->uid==current->uid, the whole hook is worthless, and only likely to create
more subtle problems in the corner cases where it might still be called but
return -EPERM. Those cases are basically when uids are different but
euid/suid is equivalent as per the check in check_kill_permission().
One example of a still-broken application is 'at' for non-root users.
This patch removes cap_task_kill().
Signed-off-by: Serge Hallyn <serge@xxxxxxxxxx>
Acked-by: Andrew G. Morgan <morgan@xxxxxxxxxx>
Tested-by: Luiz Fernando N. Capitulino <lcapitulino@xxxxxxxxxxxxxxx>
Cc: <stable@xxxxxxxxxx>
Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
---
include/linux/security.h | 3 --
security/capability.c | 1
security/commoncap.c | 40 -------------------------------------
3 files changed, 1 insertion(+), 43 deletions(-)
diff -puN include/linux/security.h~file-capabilities-remove-cap_task_kill-git include/linux/security.h
--- a/include/linux/security.h~file-capabilities-remove-cap_task_kill-git
+++ a/include/linux/security.h
@@ -57,7 +57,6 @@ extern int cap_inode_need_killpriv(struc
extern int cap_inode_killpriv(struct dentry *dentry);
extern int cap_task_post_setuid (uid_t old_ruid, uid_t old_euid, uid_t old_suid, int flags);
extern void cap_task_reparent_to_init (struct task_struct *p);
-extern int cap_task_kill(struct task_struct *p, struct siginfo *info, int sig, u32 secid);
extern int cap_task_setscheduler (struct task_struct *p, int policy, struct sched_param *lp);
extern int cap_task_setioprio (struct task_struct *p, int ioprio);
extern int cap_task_setnice (struct task_struct *p, int nice);
@@ -2187,7 +2186,7 @@ static inline int security_task_kill (st
struct siginfo *info, int sig,
u32 secid)
{
- return cap_task_kill(p, info, sig, secid);
+ return 0;
}
static inline int security_task_wait (struct task_struct *p)
diff -puN security/capability.c~file-capabilities-remove-cap_task_kill-git security/capability.c
--- a/security/capability.c~file-capabilities-remove-cap_task_kill-git
+++ a/security/capability.c
@@ -40,7 +40,6 @@ static struct security_operations capabi
.inode_need_killpriv = cap_inode_need_killpriv,
.inode_killpriv = cap_inode_killpriv,
- .task_kill = cap_task_kill,
.task_setscheduler = cap_task_setscheduler,
.task_setioprio = cap_task_setioprio,
.task_setnice = cap_task_setnice,
diff -puN security/commoncap.c~file-capabilities-remove-cap_task_kill-git security/commoncap.c
--- a/security/commoncap.c~file-capabilities-remove-cap_task_kill-git
+++ a/security/commoncap.c
@@ -540,41 +540,6 @@ int cap_task_setnice (struct task_struct
return cap_safe_nice(p);
}
-int cap_task_kill(struct task_struct *p, struct siginfo *info,
- int sig, u32 secid)
-{
- if (info != SEND_SIG_NOINFO && (is_si_special(info) || SI_FROMKERNEL(info)))
- return 0;
-
- /*
- * Running a setuid root program raises your capabilities.
- * Killing your own setuid root processes was previously
- * allowed.
- * We must preserve legacy signal behavior in this case.
- */
- if (p->uid == current->uid)
- return 0;
-
- /* sigcont is permitted within same session */
- if (sig == SIGCONT && (task_session_nr(current) == task_session_nr(p)))
- return 0;
-
- if (secid)
- /*
- * Signal sent as a particular user.
- * Capabilities are ignored. May be wrong, but it's the
- * only thing we can do at the moment.
- * Used only by usb drivers?
- */
- return 0;
- if (cap_issubset(p->cap_permitted, current->cap_permitted))
- return 0;
- if (capable(CAP_KILL))
- return 0;
-
- return -EPERM;
-}
-
/*
* called from kernel/sys.c for prctl(PR_CABSET_DROP)
* done without task_capability_lock() because it introduces
@@ -605,11 +570,6 @@ int cap_task_setnice (struct task_struct
{
return 0;
}
-int cap_task_kill(struct task_struct *p, struct siginfo *info,
- int sig, u32 secid)
-{
- return 0;
-}
#endif
void cap_task_reparent_to_init (struct task_struct *p)
_
Patches currently in -mm which might be from serue@xxxxxxxxxx are
file-capabilities-remove-cap_task_kill-git.patch
git-unionfs.patch
capabilities-implement-per-process-securebits.patch
capabilities-implement-per-process-securebits-warning-fix.patch
capabilities-implement-per-process-securebits-fix.patch
root_plug-use-cap_task_prctl.patch
smack-use-cap_task_prctl.patch
r-o-bind-mounts-stub-functions.patch
r-o-bind-mounts-elevate-write-count-for-vfs_rmdir.patch
cgroups-kernel-ns_cgroupc-should-include-linux-nsproxyh.patch
signals-cleanup-security_task_kill-usage-implementation.patch
signals-check_kill_permission-check-session-under-tasklist_lock.patch
ipc-semaphores-code-factorisation.patch
ipc-shared-memory-introduce-shmctl_down.patch
ipc-message-queues-introduce-msgctl_down.patch
ipc-semaphores-move-the-rwmutex-handling-inside-semctl_down.patch
ipc-semaphores-remove-one-unused-parameter-from-semctl_down.patch
ipc-get-rid-of-the-use-_setbuf-structure.patch
ipc-introduce-ipc_update_perm.patch
ipc-consolidate-all-xxxctl_down-functions.patch
reiser4-replace-uid==0-check-with-capability.patch
--
To unsubscribe from this list: send the line "unsubscribe mm-commits" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
