Re: [PATCH 3/6] landlock: Mediate CAP_SETPCAP for inheritable capabilities

[sashiko-bot@kernel.org]

> A process in a domain that denies CAP_SETPCAP could still add
> capabilities outside of its permitted set to its inheritable set with
> capset(2), if it held CAP_SETPCAP.  cap_capset() checks CAP_SETPCAP with
> cap_capable() in cap_inh_is_capped(), so the check never reaches
> hook_capable().  Through file inheritable capabilities, such a set can
> grant new permitted capabilities on execve() when no_new_privs is not
> set, which is possible for a domain enforced by a task holding
> CAP_SYS_ADMIN.
> 
> Add a Landlock capset hook that checks CAP_SETPCAP against the domain
> under the same condition as cap_capset().  As with the mmap_addr hook,
> LSMs implement their own policy in this hook: SELinux checks capset with
> its own permission.
> 
> Cc: Günther Noack <gnoack@google.com>
> Cc: Paul Moore <paul@paul-moore.com>
> Cc: Serge Hallyn <serge@hallyn.com>
> Reported-by: Ada Smith <adasmithgt@gmail.com>
> Fixes: 97c8386f1d74 ("landlock: Enforce capability restrictions")
> Signed-off-by: Mickaël Salaün <mic@digikod.net>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261110202436.2408244-1-mic@digikod.net?part=3