Re: [PATCH 4/6] smack: Use security_capable_lsm() for privilege checks

[sashiko-bot@kernel.org]

> smack_privileged_cred() checks the capabilities that guard Smack policy
> (CAP_MAC_ADMIN to change it, CAP_MAC_OVERRIDE to bypass it, and
> CAP_SYS_PTRACE for the ptrace rule) with cap_capable() instead of
> capable(), so that other stacked LSMs are not asked (see commit
> f28e783ff668 ("Smack: Use cap_capable in privilege check")).  This also
> lets a process in a Landlock domain that denies these capabilities
> manage or bypass Smack policy.
> 
> Switch this check to security_capable_lsm(), as for AppArmor in the
> previous commit.  The onlycap rule still applies.
> smack_privileged_cred() may check another task's credentials (the
> tracer's for the ptrace rule, the SIGIO recipient's), and may run in
> interrupt context for SIGIO delivery, which the capable_lsm hook allows.
> 
> Smack passes CAP_OPT_NONE everywhere, so Landlock logs every denial of
> these capabilities like any other capability denial.  This includes the
> checks that some Smack hooks make before their label rules (e.g.
> smack_syslog(), smack_unix_may_send()): the override is denied, and the
> label rules then decide.
> 
> Cc: Casey Schaufler <casey@schaufler-ca.com>
> Cc: Günther Noack <gnoack@google.com>
> Cc: Paul Moore <paul@paul-moore.com>
> Fixes: 97c8386f1d74 ("landlock: Enforce capability restrictions")
> Signed-off-by: Mickaël Salaün <mic@digikod.net>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261110203042.2410140-1-mic@digikod.net?part=4