From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: MIME-Version: 1.0 In-Reply-To: <1501545093-56634-9-git-send-email-keescook@chromium.org> References: <1501545093-56634-1-git-send-email-keescook@chromium.org> <1501545093-56634-9-git-send-email-keescook@chromium.org> From: Andy Lutomirski Date: Tue, 1 Aug 2017 06:46:38 -0700 Message-ID: Subject: Re: [PATCH v4 08/15] commoncap: Move cap_elevated calculation into bprm_set_creds To: Kees Cook Cc: Andrew Morton , Andy Lutomirski , David Howells , "Eric W. Biederman" , John Johansen , "Serge E. Hallyn" , Paul Moore , Stephen Smalley , Casey Schaufler , Tetsuo Handa , James Morris , Linus Torvalds , Linux FS Devel , LSM List , "linux-kernel@vger.kernel.org" Content-Type: text/plain; charset="UTF-8" Sender: linux-kernel-owner@vger.kernel.org List-ID: On Mon, Jul 31, 2017 at 4:51 PM, Kees Cook wrote: > Instead of a separate function, open-code the cap_elevated test, which > lets us entirely remove bprm->cap_effective (to use the local "effective" > variable instead), and more accurately examine euid/egid changes via the > existing local "is_setid". > > The following LTP tests were run to validate the changes: > > # ./runltp -f syscalls -s cap > # ./runltp -f securebits > # ./runltp -f cap_bounds > # ./runltp -f filecaps > > All kernel selftests for capabilities and exec continue to pass as well. > > Cc: Andy Lutomirski > Signed-off-by: Kees Cook > Reviewed-by: James Morris > Acked-by: Serge Hallyn Reviewed-by: Andy Lutomirski