Patch "io_uring: don't audit the capability check in io_uring_create()" has been added to the 5.10-stable tree

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



This is a note to let you know that I've just added the patch titled

    io_uring: don't audit the capability check in io_uring_create()

to the 5.10-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     io_uring-don-t-audit-the-capability-check-in-io_urin.patch
and it can be found in the queue-5.10 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 9a0391e825dd5ddae4f011847e39b8e41ba79913
Author: Ondrej Mosnacek <omosnace@xxxxxxxxxx>
Date:   Tue Jul 18 13:56:07 2023 +0200

    io_uring: don't audit the capability check in io_uring_create()
    
    [ Upstream commit 6adc2272aaaf84f34b652cf77f770c6fcc4b8336 ]
    
    The check being unconditional may lead to unwanted denials reported by
    LSMs when a process has the capability granted by DAC, but denied by an
    LSM. In the case of SELinux such denials are a problem, since they can't
    be effectively filtered out via the policy and when not silenced, they
    produce noise that may hide a true problem or an attack.
    
    Since not having the capability merely means that the created io_uring
    context will be accounted against the current user's RLIMIT_MEMLOCK
    limit, we can disable auditing of denials for this check by using
    ns_capable_noaudit() instead of capable().
    
    Fixes: 2b188cc1bb85 ("Add io_uring IO interface")
    Link: https://bugzilla.redhat.com/show_bug.cgi?id=2193317
    Signed-off-by: Ondrej Mosnacek <omosnace@xxxxxxxxxx>
    Reviewed-by: Jeff Moyer <jmoyer@xxxxxxxxxx>
    Link: https://lore.kernel.org/r/20230718115607.65652-1-omosnace@xxxxxxxxxx
    Signed-off-by: Jens Axboe <axboe@xxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c
index 51e6ebe72caf9..f84584b762d09 100644
--- a/io_uring/io_uring.c
+++ b/io_uring/io_uring.c
@@ -10431,7 +10431,7 @@ static int io_uring_create(unsigned entries, struct io_uring_params *p,
 	if (!ctx)
 		return -ENOMEM;
 	ctx->compat = in_compat_syscall();
-	if (!capable(CAP_IPC_LOCK))
+	if (!ns_capable_noaudit(&init_user_ns, CAP_IPC_LOCK))
 		ctx->user = get_uid(current_user());
 
 	/*



[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux