From mboxrd@z Thu Jan  1 00:00:00 1970
From: ebiederm@xmission.com (Eric W. Biederman)
Subject: Re: [PATCH 1/3] switch_creds:  Syscall to switch creds for file server ops
Date: Wed, 16 Oct 2013 20:52:58 -0700
Message-ID: <87hacgk0yt.fsf@xmission.com>
References: <1381960919-4542-1-git-send-email-jlieb@panasas.com>
	<1381960919-4542-2-git-send-email-jlieb@panasas.com>
	<20131016224248.GQ13318@ZenIV.linux.org.uk>
	<87ppr4lmp3.fsf@xmission.com>
	<20131017012050.GR13318@ZenIV.linux.org.uk>
Mime-Version: 1.0
Content-Type: text/plain
Cc: Jim Lieb <jlieb@panasas.com>, tytso@mit.edu, viro@zeniv.linux.org,
	linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org,
	bfields@redhat.com, jlayton@redhat.com
To: Al Viro <viro@ZenIV.linux.org.uk>
Return-path: <linux-kernel-owner@vger.kernel.org>
In-Reply-To: <20131017012050.GR13318@ZenIV.linux.org.uk> (Al Viro's message of
	"Thu, 17 Oct 2013 02:20:50 +0100")
Sender: linux-kernel-owner@vger.kernel.org
List-Id: linux-fsdevel.vger.kernel.org

Al Viro <viro@ZenIV.linux.org.uk> writes:

> On Wed, Oct 16, 2013 at 06:18:16PM -0700, Eric W. Biederman wrote:
>
>> That doesn't look bad but it does need capable(CAP_SETUID) &&
>> capable(CAP_SETGID) or possibly something a little more refined.
>
> D'oh
>
>> I don't think we want file descriptor passing to all of a sudden become
>> a grant of privilege, beyond what the passed fd can do.
>
> Definitely.  And an extra ) to make it compile wouldn't hurt either...

There also appears to need to be a check that we don't gain any
capabilities.

We also need a check so that you don't gain any capabilities, and
possibly a few other things.

So I suspect we want a check something like:

if ((new_cred->securebits != current_cred->securebits)  ||
    (new_cred->cap_inheritable != current_cred->cap_inheritable) ||
    (new_cred->cap_permitted != current_cred->cap_permitted) ||
    (new_cred->cap_effective != current_cred->cap_effective) ||
    (new_cred->cap_bset != current_cred->cap_bset) ||
    (new_cred->jit_keyring != current_cred->jit_keyring) ||
    (new_cred->session_keyring != current_cred->session_keyring) ||
    (new_cred->process_keyring != current_cred->process_keyring) ||
    (new_cred->thread_keyring != current_cred->thread_keyring) ||
    (new_cred->request_keyring != current_cred->request_keyring) ||
    (new_cred->security != current_cred->security) ||
    (new_cred->user_ns != current_cred->user_ns)) {
	return -EPERM;
}

Eric