Re: [PATCH 2/2] proc,security: move restriction on writing /proc/pid/attr nodes to proc

[Paul Moore <paul@paul-moore.com>]

On Fri, Dec 16, 2016 at 5:13 PM, Casey Schaufler <casey@schaufler-ca.com> wrote:
> On 12/16/2016 2:06 PM, Paul Moore wrote:
>> On Fri, Dec 16, 2016 at 12:41 PM, Stephen Smalley <sds@tycho.nsa.gov> wrote:
>>> Processes can only alter their own security attributes via
>>> /proc/pid/attr nodes.  This is presently enforced by each individual
>>> security module and is also imposed by the Linux credentials
>>> implementation, which only allows a task to alter its own credentials.
>>> Move the check enforcing this restriction from the individual
>>> security modules to proc_pid_attr_write() before calling the security hook,
>>> and drop the unnecessary task argument to the security hook since it can
>>> only ever be the current task.
>>>
>>> Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
>>> ---
>>>  fs/proc/base.c             | 13 +++++++++----
>>>  include/linux/lsm_hooks.h  |  3 +--
>>>  include/linux/security.h   |  4 ++--
>>>  security/apparmor/lsm.c    |  7 ++-----
>>>  security/security.c        |  4 ++--
>>>  security/selinux/hooks.c   | 13 +------------
>>>  security/smack/smack_lsm.c | 11 +----------
>>>  7 files changed, 18 insertions(+), 37 deletions(-)
>> Looks good to me.  I'm happy to pull this in via the SELinux tree
>> unless anyone else would rather take it?
>
> That works for me. It does need to go in atomically.

Even with all the discussion today, I still think this patch has value
and I don't believe it should impact the PTAGS work as there are
clearly larger issues that need to be resolved (e.g. reintroduce a
task based security blob?).  Unless I hear any objections that this
will wreck everything for years to come (very doubtful), I'll go ahead
and merge this into the SELinux tree tomorrow.

-- 
paul moore
www.paul-moore.com