Skip to contentSkip to conversation

cr: safely restore a task's securebits

PATCH New Serge E. Hallyn 1 participant 1 message May 27, 2009

Subsystems (3)
Security (LSM) Capabilities Credentials
lore
Share & tools
lore

Serge E. Hallyn

author
#0 lore raw

PATCH 1/1 cr: safely restore a task's securebits

As I started doing c/r of LSM credentials, I realized I wasn't handling securebit yet with the current patchet. This is on top of the set I sent out yesterday, and if I'm sendng out another full patchset then I'll integrate this back into the previous patches.

Signed-off-by Serge E. Hallyn <serue-r/[email protected]>
---
 include/linux/capability.h     |    2 +
 include/linux/checkpoint_hdr.h |    1 +
 kernel/cred.c                  |    4 +++
 security/commoncap.c           |   52 +++++++++++++++++++++++++++-------------
 4 files changed, 42 insertions(+), 17 deletions(-)
include/linux/capability.h +2 -0
index 572b5a0..b3853ca 100644
@@ -540,6 +540,8 @@ extern void checkpoint_save_cap(__u64 *dest, kernel_cap_t src);
 struct cred;
 extern int checkpoint_restore_cap(__u64 e, __u64 i, __u64 p, __u64 x,
 				struct cred *cred);
+extern void checkpoint_save_securebits(unsigned *, unsigned);
+extern int checkpoint_restore_securebits(unsigned, struct cred *);
 
 /**
  * has_capability - Determine if a task has a superior capability available
include/linux/checkpoint_hdr.h +1 -0
index 0bad447..7f65964 100644
@@ -192,6 +192,7 @@ struct ckpt_hdr_cred {
 	__u32 version; /* especially since capability sets might grow */
 	__u32 uid, suid, euid, fsuid;
 	__u32 gid, sgid, egid, fsgid;
+	__u32 securebits;
 	__u64 cap_i, cap_p, cap_e;
 	__u64 cap_x;  /* bounding set ('X') */
 	__s32 user_ref;
kernel/cred.c +4 -0
index c05192e..fe2941d 100644
@@ -739,6 +739,7 @@ int checkpoint_write_cred(struct ckpt_ctx *ctx, const struct cred *cred)
 	checkpoint_save_cap(&h->cap_p, cred->cap_permitted);
 	checkpoint_save_cap(&h->cap_e, cred->cap_effective);
 	checkpoint_save_cap(&h->cap_x, cred->cap_bset);
+	checkpoint_save_securebits(&h->securebits, cred->securebits);
 
 	h->user_ref = user_ref;
 	h->groupinfo_ref = groupinfo_ref;

@@ -811,6 +812,9 @@ struct cred *restore_read_cred(struct ckpt_ctx *ctx)
 				cred);
 	if (ret)
 		goto err_putcred;
+	ret = checkpoint_restore_securebits(h->securebits, cred);
+	if (ret)
+		goto err_putcred;
 
 	ckpt_hdr_put(ctx, h);
 	return cred;
security/commoncap.c +35 -17

71 lines not on this page · raw message

Signature · 1 line
1.6.1