lkml.org 
[lkml]   [2012]   [Jan]   [17]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    SubjectRe: [GIT] Security updates for 3.3: SELinux
    From
    Date
    On Tue, 2012-01-17 at 23:28 +0900, J. R. Okajima wrote:
    > James Morris:
    > > Eric Paris (12):
    > :::
    > > capabitlies: ns_capable can use the cap helpers rather than lsm call
    >
    > After this commit, I am afraid access(2) on NFS may not work correctly.
    > The scenario based upon my guess.
    > - access(2) overrides the credentials.
    > - calls inode_permission() -- ... -- generic_permission() --
    > ns_capable().
    > - while the old ns_capable() calls security_capable(current_cred()), the
    > new ns_capable() calls has_ns_capability(current) --
    > security_capable(__task_cred(t)).
    >
    > current_cred() returns current->cred which is effective (overridden)
    > credentials, but __task_cred(current) returns current->real_cred (the
    > NFSD's credential). And the overridden credentials by access(2) lost.
    >
    > Is my guess correct?

    Linus please revert d2a7009f0bb03fa22ad08dd25472efa0568126b9

    Your explanation seems plausible. I will review the rest and make sure
    a similar problem was not introduced elsewhere.

    -Eric



    \
     
     \ /
      Last update: 2012-01-17 15:41    [W:0.022 / U:0.144 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site