Re: [PATCH 1/2] capabilities: Check PR_SET_SECUREBITS with ns_capable()

[sashiko-bot@kernel.org]

> Per-process securebits were introduced with a direct cap_capable() check
> for CAP_SETPCAP.  The capable LSM hook and SELinux capability policy
> already existed, and SELinux forwarded task_prctl operations to
> commoncap.  The direct call therefore bypassed SELinux policy from the
> start.  It now also bypasses AppArmor, Landlock, and BPF LSM programs
> attached to the capable hook.
> 
> A task with CAP_SETPCAP in its effective set can consequently change
> privileged securebits despite an LSM denial.  This can alter how its
> capabilities evolve across UID and execution transitions without the
> expected LSM denial or audit record.
> 
> Use ns_capable(), as cap_prctl_drop() already does for PR_CAPBSET_DROP.
> Call it only for a no-op, which requires privilege for legacy reasons,
> or when a privileged bit changes.  Changes limited to
> [ ... ]
> Cc: Stephen Smalley <stephen.smalley.work@gmail.com>
> Cc: stable@vger.kernel.org
> Reported-by: Ada Smith <adasmithgt@gmail.com>
> Fixes: 3898b1b4ebff ("capabilities: implement per-process securebits")
> Signed-off-by: Mickaël Salaün <mic@digikod.net>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261110202811.2409395-1-mic@digikod.net?part=1