filesystems: use has_capability_noaudit interface for reserved blocks checks
Subsystems (6)
PATCH 1/1 filesystems: use has_capability_noaudit interface for reserved blocks checks
ext[2,3,4], ufs, and ubifs all check for CAP_SYS_RESOURCE to determine if they should allow reserved blocks to be used. A process not having this capability is not failing some security decision and should not be audited. Thus move to using has_capability_noaudit.
---
I would like to push this patch through the security tree (since that's the only place the new cap_noaudit interface exists), but I'd like to get an ACK from each subsystem maintainer.
fs/ext2/balloc.c | 2 +- fs/ext3/balloc.c | 2 +- fs/ext4/balloc.c | 2 +- fs/ubifs/budget.c | 3 ++- fs/ufs/balloc.c | 2 +- security/commoncap.c | 1 + security/security.c | 1 + 7 files changed, 8 insertions(+), 5 deletions(-)
fs/ext2/balloc.c +1 -1
@@ -1192,7 +1192,7 @@ static int ext2_has_free_blocks(struct ext2_sb_info *sbi) free_blocks =percpu_counter_read_positive (&sbi->s_freeblocks_counter); root_blocks =le32_to_cpu (sbi->s_es->s_r_blocks_count); -if (free_blocks < root_blocks +1 && !capable (CAP_SYS_RESOURCE ) && +if (free_blocks < root_blocks +1 && !has_capability_noaudit (current,CAP_SYS_RESOURCE ) && sbi->s_resuid != current->fsuid && (sbi->s_resgid ==0 || !in_group_p (sbi->s_resgid))) {return 0 ;
fs/ext3/balloc.c +1 -1
@@ -1421,7 +1421,7 @@ static int ext3_has_free_blocks(struct ext3_sb_info *sbi) free_blocks =percpu_counter_read_positive (&sbi->s_freeblocks_counter); root_blocks =le32_to_cpu (sbi->s_es->s_r_blocks_count); -if (free_blocks < root_blocks +1 && !capable (CAP_SYS_RESOURCE ) && +if (free_blocks < root_blocks +1 && !has_capability_noaudit (current,CAP_SYS_RESOURCE ) && sbi->s_resuid != current->fsuid && (sbi->s_resgid ==0 || !in_group_p (sbi->s_resgid))) {return 0 ;
fs/ext4/balloc.c +1 -1
@@ -626,7 +626,7 @@ int ext4_has_free_blocks(struct ext4_sb_info *sbi, s64 nblocks)/* Hm, nope. Are (enough) root reserved blocks available? */ if (sbi->s_resuid == current->fsuid || ((sbi->s_resgid !=0 ) &&in_group_p (sbi->s_resgid)) || -capable (CAP_SYS_RESOURCE )) { +has_capability_noaudit (current,CAP_SYS_RESOURCE )) {if (free_blocks >= (nblocks + dirty_blocks))return 1 ; }
fs/ubifs/budget.c +2 -1
@@ -32,6 +32,7 @@#include "ubifs.h" #include <linux/writeback.h> +#include <linux/capability.h> #include <asm/div64.h> /*
@@ -363,7 +364,7 @@ long long ubifs_calc_available(const struct ubifs_info *c, int min_idx_lebs)*/ static int can_use_rp (struct ubifs_info *c) { -if (current->fsuid == c->rp_uid ||capable (CAP_SYS_RESOURCE ) || +if (current->fsuid == c->rp_uid ||has_capability_noaudit (current,CAP_SYS_RESOURCE ) || (c->rp_gid !=0 &&in_group_p (c->rp_gid)))return 1 ;return 0 ;
fs/ufs/balloc.c +1 -1
@@ -411,7 +411,7 @@ u64 ufs_new_fragments(struct inode *inode, void *p, u64 fragment,/* * There is not enough space for user on the device */ -if (!capable (CAP_SYS_RESOURCE ) &&ufs_freespace (uspi,UFS_MINFREE ) <=0 ) { +if (!has_capability_noaudit (current,CAP_SYS_RESOURCE ) &&ufs_freespace (uspi,UFS_MINFREE ) <=0 ) {unlock_super (sb);UFSD ("EXIT (FAILED)\n" );return 0 ;
security/commoncap.c +1 -0
@@ -55,6 +55,7 @@ int cap_capable(struct task_struct *tsk, int cap, int audit)return 0 ;return -EPERM ; } +EXPORT_SYMBOL (cap_capable);int cap_settime (struct timespec *ts,struct timezone *tz) {
security/security.c +1 -0
@@ -170,6 +170,7 @@ int security_capable_noaudit(struct task_struct *tsk, int cap) {return security_ops->capable (tsk, cap,SECURITY_CAP_NOAUDIT ); } +EXPORT_SYMBOL (security_capable_noaudit);int security_acct (struct file *file) {
Quoted 5 lines · 在 2008-11-11二的 14:12 -0500，Eric Paris写道：
ext[2,3,4], ufs, and ubifs all check for
CAP_SYS_RESOURCEto determine if they should allow reserved blocks to be used. A process not having this capability is not failing some security decision and should not be audited. Thus move to usinghas_capability_noaudit.
Looks fine to me.
Eric Sandeen has mentioned earlier about the security audit issue with ext4. We fixed it in ext4, with this it is even better.
Quoted 117 lines
Signed-off-by Eric Paris <[email protected]>---
I would like to push this patch through the security tree (since that's the only place the new
cap_noauditinterface exists), but I'd like to get an ACK from each subsystem maintainer.fs/ext2/balloc.c | 2 +- fs/ext3/balloc.c | 2 +- fs/ext4/balloc.c | 2 +- fs/ubifs/budget.c | 3 ++- fs/ufs/balloc.c | 2 +- security/commoncap.c | 1 + security/security.c | 1 + 7 files changed, 8 insertions(+), 5 deletions(-)fs/ext2/balloc.c +1
-1@@ -1192,7 +1192,7 @@ static int ext2_has_free_blocks(struct ext2_sb_info *sbi) free_blocks =percpu_counter_read_positive (&sbi->s_freeblocks_counter); root_blocks =le32_to_cpu (sbi->s_es->s_r_blocks_count); -if (free_blocks < root_blocks +1 && !capable (CAP_SYS_RESOURCE ) && +if (free_blocks < root_blocks +1 && !has_capability_noaudit (current,CAP_SYS_RESOURCE ) && sbi->s_resuid != current->fsuid && (sbi->s_resgid ==0 || !in_group_p (sbi->s_resgid))) {return 0 ;fs/ext3/balloc.c +1
-1@@ -1421,7 +1421,7 @@ static int ext3_has_free_blocks(struct ext3_sb_info *sbi) free_blocks =percpu_counter_read_positive (&sbi->s_freeblocks_counter); root_blocks =le32_to_cpu (sbi->s_es->s_r_blocks_count); -if (free_blocks < root_blocks +1 && !capable (CAP_SYS_RESOURCE ) && +if (free_blocks < root_blocks +1 && !has_capability_noaudit (current,CAP_SYS_RESOURCE ) && sbi->s_resuid != current->fsuid && (sbi->s_resgid ==0 || !in_group_p (sbi->s_resgid))) {return 0 ;fs/ext4/balloc.c +1
-1@@ -626,7 +626,7 @@ int ext4_has_free_blocks(struct ext4_sb_info *sbi, s64 nblocks)/* Hm, nope. Are (enough) root reserved blocks available? */ if (sbi->s_resuid == current->fsuid || ((sbi->s_resgid !=0 ) &&in_group_p (sbi->s_resgid)) || -capable (CAP_SYS_RESOURCE )) { +has_capability_noaudit (current,CAP_SYS_RESOURCE )) {if (free_blocks >= (nblocks + dirty_blocks))return 1 ; }fs/ubifs/budget.c +2
-1@@ -32,6 +32,7 @@#include "ubifs.h" #include <linux/writeback.h> +#include <linux/capability.h> #include <asm/div64.h> /* @@ -363,7 +364,7 @@ long long ubifs_calc_available(const struct ubifs_info *c, int min_idx_lebs)*/ static int can_use_rp (struct ubifs_info *c) { -if (current->fsuid == c->rp_uid ||capable (CAP_SYS_RESOURCE ) || +if (current->fsuid == c->rp_uid ||has_capability_noaudit (current,CAP_SYS_RESOURCE ) || (c->rp_gid !=0 &&in_group_p (c->rp_gid)))return 1 ;return 0 ;fs/ufs/balloc.c +1
-1@@ -411,7 +411,7 @@ u64 ufs_new_fragments(struct inode *inode, void *p, u64 fragment,/* * There is not enough space for user on the device */ -if (!capable (CAP_SYS_RESOURCE ) &&ufs_freespace (uspi,UFS_MINFREE ) <=0 ) { +if (!has_capability_noaudit (current,CAP_SYS_RESOURCE ) &&ufs_freespace (uspi,UFS_MINFREE ) <=0 ) {unlock_super (sb);UFSD ("EXIT (FAILED)\n" );return 0 ;security/commoncap.c +1
-0@@ -55,6 +55,7 @@ int cap_capable(struct task_struct *tsk, int cap, int audit)return 0 ;return -EPERM ; } +EXPORT_SYMBOL (cap_capable);int cap_settime (struct timespec *ts,struct timezone *tz) {security/security.c +1
-1@@ -170,6 +170,7 @@ int security_capable_noaudit(struct task_struct *tsk, int cap) {return security_ops->capable (tsk, cap,SECURITY_CAP_NOAUDIT ); } +EXPORT_SYMBOL (security_capable_noaudit);int security_acct (struct file *file) { --
Quoted 3 lines
To unsubscribe from this list: send the line "unsubscribe linux-ext4" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
--
To unsubscribe from this list: send the line "unsubscribe linux-ext4" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
Quoted 11 lines · On Tue, 11 Nov 2008 14:12:49 -0500 Eric Paris <[email protected]> wrote:
ext[2,3,4], ufs, and ubifs all check for
CAP_SYS_RESOURCEto determine if they should allow reserved blocks to be used. A process not having this capability is not failing some security decision and should not be audited. Thus move to usinghas_capability_noaudit.Signed-off-by Eric Paris <[email protected]>---
I would like to push this patch through the security tree (since that's the only place the new
cap_noauditinterface exists), but I'd like to get an ACK from each subsystem maintainer.
OK by me.
Whoever added has_capability_noaudit() forgot to document it, so the difference between has_capability_noaudit() and has_capability() eludes this reader.
Quoted 8 lines · Andrew Morton
Quoted 5 lines · On Tue, 11 Nov 2008 14:12:49 -0500 Eric Paris <[email protected]> wrote:
ext[2,3,4], ufs, and ubifs all check for
CAP_SYS_RESOURCEto determine if they should allow reserved blocks to be used. A process not having this capability is not failing some security decision and should not be audited. Thus move to usinghas_capability_noaudit.
Quoted 6 lines
Quoted 6 lines
Signed-off-by Eric Paris <[email protected]>---
I would like to push this patch through the security tree (since that's the only place the new
cap_noauditinterface exists), but I'd like to get an ACK from each subsystem maintainer.
For ext4:
- Ted
Quoted 7 lines · Eric Paris
ext[2,3,4], ufs, and ubifs all check for
CAP_SYS_RESOURCEto determine if they should allow reserved blocks to be used. A process not having this capability is not failing some security decision and should not be audited. Thus move to usinghas_capability_noaudit.Signed-off-by Eric Paris <[email protected]>---
UBIFS part looks OK, as long as the whole idea of the patch is right, which I have not checked, but assume it is.
The only question is are you sure exporting 'cap_capable()' is relevant to this patch? You do not seem to call it directly.
Signature · 2 lines
Best Regards, Artem Bityutskiy (Артём Битюцкий)
Quoted 6 lines · Artem Bityutskiy
Quoted 5 lines · Eric Paris
ext[2,3,4], ufs, and ubifs all check for
CAP_SYS_RESOURCEto determine if they should allow reserved blocks to be used. A process not having this capability is not failing some security decision and should not be audited. Thus move to usinghas_capability_noaudit.
Quoted 8 lines
Quoted 2 lines
Signed-off-by Eric Paris <[email protected]>---
UBIFS part looks OK, as long as the whole idea of the patch is right, which I have not checked, but assume it is.
The only question is are you sure exporting '
cap_capable()' is relevant to this patch? You do not seem to call it directly.
After this change, modules call has_capability_noaudit() which is a #define which turns this into modules calling security_capable_noaudit(). You noticed this and decided it was correct to make that export. But when CONFIG_SECURITY is not set security_capable_notaudit() is a static inline which calls cap_capable(). See include/linux/security.h line 2832 in the linux-next tree. Now modules are calling cap_capable directly, thus the export.
-Eric