From: Kees Cook <keescook@chromium.org>
To: Kevin Locke <kevin@kevinlocke.name>,
Josh Triplett <josh@joshtriplett.org>,
Linus Torvalds <torvalds@linux-foundation.org>,
John Johansen <john.johansen@canonical.com>,
Paul Moore <paul@paul-moore.com>,
James Morris <jmorris@namei.org>,
"Serge E. Hallyn" <serge@hallyn.com>,
Kentaro Takeda <takedakn@nttdata.co.jp>,
Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>,
Alexander Viro <viro@zeniv.linux.org.uk>,
Christian Brauner <brauner@kernel.org>, Jan Kara <jack@suse.cz>,
Eric Biederman <ebiederm@xmission.com>,
Andrew Morton <akpm@linux-foundation.org>,
Sebastian Andrzej Siewior <bigeasy@linutronix.de>,
linux-fsdevel@vger.kernel.org, linux-mm@kvack.org,
apparmor@lists.ubuntu.com, linux-security-module@vger.kernel.org,
linux-kernel@vger.kernel.org, linux-hardening@vger.kernel.org
Subject: Re: [PATCH] exec: Check __FMODE_EXEC instead of in_execve for LSMs
Date: Wed, 24 Jan 2024 11:51:49 -0800 [thread overview]
Message-ID: <202401241151.25D468FE@keescook> (raw)
In-Reply-To: <ZbFneq3URF5lLAT7@kevinlocke.name>
On Wed, Jan 24, 2024 at 12:39:38PM -0700, Kevin Locke wrote:
> On Wed, 2024-01-24 at 11:22 -0800, Kees Cook wrote:
> > After commit 978ffcbf00d8 ("execve: open the executable file before
> > doing anything else"), current->in_execve was no longer in sync with the
> > open(). This broke AppArmor and TOMOYO which depend on this flag to
> > distinguish "open" operations from being "exec" operations.
> >
> > Instead of moving around in_execve, switch to using __FMODE_EXEC, which
> > is where the "is this an exec?" intent is stored. Note that TOMOYO still
> > uses in_execve around cred handling.
>
> It solves the AppArmor issue I was experiencing and I don't notice any
> other issues.
>
> Tested-by: Kevin Locke <kevin@kevinlocke.name>
Thanks!
Sounds like Linus has taken the patch directly, and I'll send a follow-up
PR with other clean-ups.
-Kees
--
Kees Cook
next prev parent reply other threads:[~2024-01-24 19:51 UTC|newest]
Thread overview: 15+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-01-24 19:22 [PATCH] exec: Check __FMODE_EXEC instead of in_execve for LSMs Kees Cook
2024-01-24 19:39 ` Kevin Locke
2024-01-24 19:51 ` Kees Cook [this message]
2024-01-24 19:58 ` Jann Horn
2024-01-24 20:15 ` Kees Cook
2024-01-24 20:47 ` Linus Torvalds
2024-01-24 20:51 ` Jann Horn
2024-01-24 21:32 ` Kees Cook
2024-01-24 21:35 ` Kees Cook
2024-01-24 21:40 ` Jann Horn
2024-01-24 21:50 ` Kees Cook
2024-01-25 14:34 ` Tetsuo Handa
2024-01-25 14:59 ` Jann Horn
2024-01-25 16:38 ` Mickaël Salaün
2024-01-27 4:53 ` John Johansen
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=202401241151.25D468FE@keescook \
--to=keescook@chromium.org \
--cc=akpm@linux-foundation.org \
--cc=apparmor@lists.ubuntu.com \
--cc=bigeasy@linutronix.de \
--cc=brauner@kernel.org \
--cc=ebiederm@xmission.com \
--cc=jack@suse.cz \
--cc=jmorris@namei.org \
--cc=john.johansen@canonical.com \
--cc=josh@joshtriplett.org \
--cc=kevin@kevinlocke.name \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-hardening@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=linux-security-module@vger.kernel.org \
--cc=paul@paul-moore.com \
--cc=penguin-kernel@i-love.sakura.ne.jp \
--cc=serge@hallyn.com \
--cc=takedakn@nttdata.co.jp \
--cc=torvalds@linux-foundation.org \
--cc=viro@zeniv.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.