groups: Factor out a function to set a pre-sorted group list
PATCH v2 1/2 groups: Factor out a function to set a pre-sorted group list
This way, functions that already need to sort the group list need not do so twice.
The new set_groups_sorted is intentionally not exported.
--- kernel/groups.c | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-)
kernel/groups.c +13 -3
@@ -154,16 +154,26 @@ int groups_search(const struct group_info *group_info, kgid_t grp) }/** +* set_groups_sorted - Change a group subscription in a set of credentials +* @new: The newly prepared set of credentials to alter +* @group_info: The group list to install; must be sorted +*/ +static void set_groups_sorted (struct cred *new,struct group_info *group_info) +{ +put_group_info (new->group_info); +get_group_info (group_info); + new->group_info = group_info; +} + +/** * set_groups - Change a group subscription in a set of credentials * @new: The newly prepared set of credentials to alter * @group_info: The group list to install */ void set_groups (struct cred *new,struct group_info *group_info) { -put_group_info (new->group_info);groups_sort (group_info); -get_group_info (group_info); - new->group_info = group_info; +set_groups_sorted (new, group_info); }EXPORT_SYMBOL (set_groups);
Signature · 1 line
2.1.3
PATCH v2 2/2 groups: Allow unprivileged processes to use setgroups to drop groups
Currently, unprivileged processes (without CAP_SETGID) cannot call setgroups at all. In particular, processes with a set of supplementary groups cannot further drop permissions without obtaining elevated permissions first.
Allow unprivileged processes to call setgroups with a subset of their current groups; only require CAP_SETGID to add a group the process does not currently have.
Since some privileged programs (such as sudo) allow tests for non-membership in a group, require no_new_privs to drop group privileges.
The kernel already maintains the list of supplementary group IDs in sorted order, and setgroups already needs to sort the new list, so this just requires a linear comparison of the two sorted lists.
This moves the CAP_SETGID test from setgroups into set_current_groups.
Tested via the following test program:
void run_id(void)
{
pid_t p = fork();
switch (p) {
case -1:
err(1, "fork");
case 0:
execl("/usr/bin/id", "id", NULL);
err(1, "exec");
default:
if (waitpid(p, NULL, 0) < 0)
err(1, "waitpid");
}
}int main(void)
{
gid_t list1[] = { 1, 2, 3, 4, 5 };
gid_t list2[] = { 2, 3, 4 };
run_id();
if (setgroups(5, list1) < 0)
err(1, "setgroups 1");
run_id();
if (setresgid(1, 1, 1) < 0)
err(1, "setresgid");
if (setresuid(1, 1, 1) < 0)
err(1, "setresuid");
run_id();
if (setgroups(3, list2) < 0)
err(1, "setgroups 2");
run_id();
if (setgroups(5, list1) < 0)
err(1, "setgroups 3");
run_id();
return 0;
}Without this patch, the test program gets EPERM from the second setgroups call, after dropping root privileges. With this patch, the test program successfully drops groups 1 and 5, but then gets EPERM from the third setgroups call, since that call attempts to add groups the process does not currently have.
---
v2: Require no_new_privs.
kernel/groups.c | 34 +++++++++++++++++++++++++++++++--- kernel/uid16.c | 2 -- 2 files changed, 31 insertions(+), 5 deletions(-)
kernel/groups.c +31 -3
@@ -153,6 +153,29 @@ int groups_search(const struct group_info *group_info, kgid_t grp)return 0 ; } +/* Compare two sorted group lists; return true if the first is a subset of the +* second. +*/ +static bool is_subset (const struct group_info *g1,const struct group_info *g2) +{ +unsigned int i, j; + +for (i =0 , j =0 ; i < g1->ngroups; i++) { +kgid_t gid1 =GROUP_AT (g1, i); +kgid_t gid2; +for (; j < g2->ngroups; j++) { + gid2 =GROUP_AT (g2, j); +if (gid_lte (gid1, gid2)) +break ; + } +if (j >= g2->ngroups || !gid_eq (gid1, gid2)) +return false; + j++; + } + +return true; +} +/** * set_groups_sorted - Change a group subscription in a set of credentials * @new: The newly prepared set of credentials to alter
@@ -189,11 +212,18 @@ int set_current_groups(struct group_info *group_info) {struct cred *new; +groups_sort (group_info); new =prepare_creds ();if (!new)return -ENOMEM ; +if (!(ns_capable (current_user_ns (),CAP_SETGID ) + || (task_no_new_privs (current) + &&is_subset (group_info, new->group_info)))) { +abort_creds (new); +return -EPERM ; + } -set_groups (new, group_info); +set_groups_sorted (new, group_info);return commit_creds (new); }
@@ -233,8 +263,6 @@ SYSCALL_DEFINE2(setgroups, int, gidsetsize, gid_t __user *, grouplist)struct group_info *group_info;int retval; -if (!ns_capable (current_user_ns (),CAP_SETGID )) -return -EPERM ;if ((unsigned )gidsetsize >NGROUPS_MAX )return -EINVAL ;
kernel/uid16.c +0 -2
@@ -176,8 +176,6 @@ SYSCALL_DEFINE2(setgroups16, int, gidsetsize, old_gid_t __user *, grouplist)struct group_info *group_info;int retval; -if (!ns_capable (current_user_ns (),CAP_SETGID )) -return -EPERM ;if ((unsigned )gidsetsize >NGROUPS_MAX )return -EINVAL ;
Signature · 6 lines
2.1.3 -- To unsubscribe from this list: send the line "unsubscribe linux-man" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html
PATCH v2 1/1 getgroups.2: Document unprivileged setgroups calls
In reply to Josh Triplett---
v2: Document requirement for no_new_privs.
(If this doesn't end up going into 3.18, the version number in the patch will need updating.)
man2/getgroups.2 | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
man2/getgroups.2 +4 -2
@@ -81,9 +81,11 @@ to be used in a further call to .PP .BR setgroups () sets the supplementary group IDs for the calling process. -Appropriate privileges (Linux: the +As of Linux 3.18, any process that has enabled PR_SET_NO_NEW_PRIVS may drop +supplementary groups, but may not add new groups. Adding groups, or making any +change at all without no_new_privs enabled, requires the .B CAP_SETGID -capability) are required. +capability. The .I size argument specifies the number of supplementary group IDs
Signature · 1 line
2.1.3