lkml.org 
[lkml]   [2005]   [May]   [20]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[updated patch 3/7] BSD Secure Levels: allow suid and sgid on directories
    This patch is applies cleanly against the new printk() patch.  It
    allows setuid and setgid on directories. It also disallows the
    creation of setuid/setgid executables via open or mknod.

    Signed off by: Michael Halcrow <mhalcrow@us.ibm.com>

    Index: linux-2.6.12-rc4-mm2-seclvl/security/seclvl.c
    ===================================================================
    --- linux-2.6.12-rc4-mm2-seclvl.orig/security/seclvl.c 2005-05-19 17:46:13.000000000 -0500
    +++ linux-2.6.12-rc4-mm2-seclvl/security/seclvl.c 2005-05-20 09:09:03.000000000 -0500
    @@ -582,7 +582,11 @@
    static int seclvl_inode_setattr(struct dentry *dentry, struct iattr *iattr)
    {
    if (seclvl > 0) {
    - if (iattr->ia_valid & ATTR_MODE)
    + if (dentry && dentry->d_inode
    + && S_ISDIR(dentry->d_inode->i_mode)) {
    + return 0;
    + }
    + if (iattr && iattr->ia_valid & ATTR_MODE)
    if (iattr->ia_mode & S_ISUID ||
    iattr->ia_mode & S_ISGID) {
    seclvl_printk(1, KERN_WARNING, "Attempt to "
    @@ -596,6 +600,34 @@
    }

    /**
    + * Prevent an end-run around the inode_setattr control.
    + */
    +static int seclvl_inode_mknod(struct inode *inode, struct dentry *dentry,
    + int mode, dev_t dev)
    +{
    + if (seclvl > 0 && (mode & 02000 || mode & 04000)) {
    + seclvl_printk(1, KERN_WARNING, "Attempt to mknod with suid "
    + "or guid bit set in seclvl [%d]\n", seclvl);
    + return -EPERM;
    + }
    + return 0;
    +}
    +
    +/**
    + * Prevent an end-run around the inode_setattr control.
    + */
    +static int
    +seclvl_inode_create(struct inode *inode, struct dentry *dentry, int mask)
    +{
    + if (seclvl > 0 && (mask & 02000 || mask & 04000)) {
    + seclvl_printk(1, KERN_WARNING, "Attempt to create inode with "
    + "suid or guid bit set in seclvl [%d]\n", seclvl);
    + return -EPERM;
    + }
    + return 0;
    +}
    +
    +/**
    * Release busied block devices.
    */
    static void seclvl_file_free_security(struct file *filp)
    @@ -630,6 +662,8 @@
    .file_permission = seclvl_file_permission,
    .file_mmap = seclvl_file_mmap,
    .inode_setattr = seclvl_inode_setattr,
    + .inode_mknod = seclvl_inode_mknod,
    + .inode_create = seclvl_inode_create,
    .file_free_security = seclvl_file_free_security,
    .settime = seclvl_settime,
    .sb_umount = seclvl_umount,
    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/
    \
     
     \ /
      Last update: 2005-05-20 17:12    [W:0.024 / U:0.208 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site