[kernel-hardening] Re: [RFC v2] security: intoduce ptrace_task_may_access_current

Vasiliy Kulikov
2011-06-20T15:44:29Z

On Mon, Jun 20, 2011 at 10:00 -0500, Serge Hallyn wrote:
> > >diff --git a/kernel/capability.c b/kernel/capability.c
> > >index 283c529..bc9b07f 100644
> > >--- a/kernel/capability.c
> > >+++ b/kernel/capability.c
> > >@@ -356,6 +356,30 @@ bool capable(int cap)
> > > }
> > > EXPORT_SYMBOL(capable);
> > >
> > >+bool task_capable(struct task_struct *task, int cap)
> > >+{
> > >+ return ns_task_capable(task,&init_user_ns, cap);
> > >+}
> > >+EXPORT_SYMBOL(task_capable);
> >
> > Why do we keep adding things like task_capable? Can't we just stop
> > adding non-lsm functions and just call the right LSM functions from
> > now on? This is my original comments mostly directed at Serge. I'm
> > to the point where I want to NAK anything new in kernel/capability.c
> > (and yes, I know i'm guilty in the paste)
> >
> > >+bool ns_task_capable(struct task_struct *task, struct user_namespace *ns, int cap)
>
> Can you just use has_ns_capability() at the places where you wanted to
> use your new ns_task_capable()? It won't set PF_SUPERPRIV, but you
> can't set that on another task anyway IIRC.

has_ns_capability() doesn't touch LSMs, but ns_task_capable() uses
security_task_capable() which uses LSMs.

Actually, I'm a bit confused in sense of what capable functions should
be used in specific cases. Where we need to inform LSM and where not.
I don't want to bypass LSMs where it should not do it otherwise. In the
patch I've copied alredy existing behaviour leaving LSM iteraction
as-is.

Thanks,

--
Vasiliy Kulikov
http://www.openwall.com - bringing security into open computing environments