lkml.org 
[lkml]   [2007]   [Nov]   [26]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[PATCH] file capabilities: don't prevent signaling setuid root programs.
    This patch is needed to preserve legacy behavior when
    CONFIG_SECURITY_FILE_CAPABILITIES=y. Without this patch, xinit can't
    kill X, so manually starting X in runlevel 3 then exiting your window
    manager will not cause X to exit.

    thanks,
    -serge

    From 81a6d780ad570f9a326fc27912ec0e373f5fa14f Mon Sep 17 00:00:00 2001
    From: Serge E. Hallyn <serue@us.ibm.com>
    Date: Tue, 20 Nov 2007 08:47:35 +0000
    Subject: [PATCH] file capabilities: don't prevent signaling setuid root programs.

    An unprivileged process must be able to kill a setuid root
    program started by the same user. This is legacy behavior
    needed for instance for xinit to kill X when the window manager
    exits.

    When an unprivileged user runs a setuid root program in !SECURE_NOROOT
    mode, fP, fI, and fE are set full on, so pP' and pE' are full on.
    Then cap_task_kill() prevents the user from signaling the setuid root
    task. This is a change in behavior compared to when
    !CONFIG_SECURITY_FILE_CAPABILITIES.

    This patch introduces a special check into cap_task_kill() just
    to check whether a non-root user is signaling a setuid root
    program started by the same user. If so, then signal is allowed.

    Changelog:
    Nov 26: move test up above CAP_KILL test as per Andrew
    Morgan's suggestion.

    Signed-off-by: Serge E. Hallyn <serue@us.ibm.com>
    ---
    security/commoncap.c | 9 +++++++++
    1 files changed, 9 insertions(+), 0 deletions(-)

    diff --git a/security/commoncap.c b/security/commoncap.c
    index 302e8d0..5bc1895 100644
    --- a/security/commoncap.c
    +++ b/security/commoncap.c
    @@ -526,6 +526,15 @@ int cap_task_kill(struct task_struct *p, struct siginfo *info,
    if (info != SEND_SIG_NOINFO && (is_si_special(info) || SI_FROMKERNEL(info)))
    return 0;

    + /*
    + * Running a setuid root program raises your capabilities.
    + * Killing your own setuid root processes was previously
    + * allowed.
    + * We must preserve legacy signal behavior in this case.
    + */
    + if (p->euid == 0 && p->uid == current->uid)
    + return 0;
    +
    /* sigcont is permitted within same session */
    if (sig == SIGCONT && (task_session_nr(current) == task_session_nr(p)))
    return 0;
    --
    1.5.2.5
    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2007-11-26 19:03    [W:0.067 / U:0.008 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site