tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

ipc: don't audit capability check in ipc_permissions()

The IPC sysctls implement the ctl_table_root::permissions hook and
they override the file access mode based on the CAP_CHECKPOINT_RESTORE
capability, which is being checked regardless of whether any access is
actually denied or not, so if an LSM denies the capability, an audit
record may be logged even when access is in fact granted.

It wouldn't be viable to restructure the sysctl permission logic to only
check the capability when the access would be actually denied if it's
not granted. Thus, do the same as in net_ctl_permissions()
(net/sysctl_net.c) - switch from ns_capable() to ns_capable_noaudit(),
so that the check never emits an audit record.

Fixes: 0889f44e2810 ("ipc: Check permissions for checkpoint_restart sysctls at open time")
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Acked-by: Alexey Gladkov <legion@kernel.org>
Acked-by: Serge Hallyn <serge@hallyn.com>
Signed-off-by: Serge Hallyn <sergeh@kernel.org>

authored by

Ondrej Mosnacek and committed by
Serge Hallyn 07158813 24e9b431

+7 -1
+6
include/linux/capability.h
··· 203 203 ns_capable(ns, CAP_SYS_ADMIN); 204 204 } 205 205 206 + static inline bool checkpoint_restore_ns_capable_noaudit(struct user_namespace *ns) 207 + { 208 + return ns_capable_noaudit(ns, CAP_CHECKPOINT_RESTORE) || 209 + ns_capable_noaudit(ns, CAP_SYS_ADMIN); 210 + } 211 + 206 212 /* audit system wants to get cap info from files as well */ 207 213 int get_vfs_caps_from_disk(struct mnt_idmap *idmap, 208 214 const struct dentry *dentry,
+1 -1
ipc/ipc_sysctl.c
··· 214 214 if (((table->data == &ns->ids[IPC_SEM_IDS].next_id) || 215 215 (table->data == &ns->ids[IPC_MSG_IDS].next_id) || 216 216 (table->data == &ns->ids[IPC_SHM_IDS].next_id)) && 217 - checkpoint_restore_ns_capable(ns->user_ns)) 217 + checkpoint_restore_ns_capable_noaudit(ns->user_ns)) 218 218 mode = 0666; 219 219 else 220 220 #endif