[GIT PULL] SafeSetID changes for v6.0

[GIT PULL] SafeSetID changes for v6.0

[Micah Morton]

The following changes since commit 32346491ddf24599decca06190ebca03ff9de7f8:


  Linux 5.19-rc6 (2022-07-10 14:40:51 -0700)


are available in the Git repository at:


  https://github.com/micah-morton/linux.git tags/safesetid-6.0


for you to fetch changes up to 64b634830c919979de4b18163e15d30df66e64a8:


  LSM: SafeSetID: add setgroups() testing to selftest (2022-07-15
18:24:42 +0000)


----------------------------------------------------------------

This pull request contains one commit that touches common kernel code,

one that adds functionality internal to the SafeSetID LSM code, and a

few other commits that only modify the SafeSetID LSM selftest.


The commit that touches common kernel code simply adds an LSM hook in

the setgroups() syscall that mirrors what is done for the existing LSM

hooks in the setuid() and setgid() syscalls. This commit combined with

the SafeSetID-specific one allow the LSM to filter setgroups() calls

according to configured rule sets in the same way that is already done

for setuid() and setgid().


The changes are based on v5.19-rc6 and have been in -next.


----------------------------------------------------------------

Micah Morton (6):

      LSM: SafeSetID: fix userns bug in selftest

      LSM: SafeSetID: selftest cleanup and prepare for GIDs

      LSM: SafeSetID: add GID testing to selftest

      security: Add LSM hook to setgroups() syscall

      LSM: SafeSetID: Add setgroups() security policy handling

      LSM: SafeSetID: add setgroups() testing to selftest


 include/linux/lsm_hook_defs.h                      |   1 +

 include/linux/lsm_hooks.h                          |   7 +

 include/linux/security.h                           |   7 +

 kernel/groups.c                                    |  13 +

 security/safesetid/lsm.c                           |  39 ++-

 security/security.c                                |   5 +

 tools/testing/selftests/safesetid/Makefile         |   2 +-

 tools/testing/selftests/safesetid/safesetid-test.c | 295 ++++++++++++++++++---

 8 files changed, 315 insertions(+), 54 deletions(-)

Re: [GIT PULL] SafeSetID changes for v6.0

[Linus Torvalds]

On Mon, Aug 1, 2022 at 7:40 PM Micah Morton <mortonm@chromium.org> wrote:
>
> This pull request contains one commit that touches common kernel code,
>
> one that adds functionality internal to the SafeSetID LSM code, and a
>
> few other commits that only modify the SafeSetID LSM selftest.
[...]

What odd MUA do you use that causes this double-spaced text email?

I can read it, but it really is a bit strange. It was all plain text,
and marked as utf-8, and otherwise looked normal except for that
double spacing.

I get flashbacks to my "writing papers at university" days.

             Linus

Re: [GIT PULL] SafeSetID changes for v6.0

[pr-tracker-bot]

The pull request you sent on Mon, 1 Aug 2022 19:42:26 -0700:

> https://github.com/micah-morton/linux.git tags/safesetid-6.0

has been merged into torvalds/linux.git:
https://git.kernel.org/torvalds/c/87fe1adb66a514fa3abbe8bdb4278a5b2f421d8b

Thank you!

-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/prtracker.html

Re: [GIT PULL] SafeSetID changes for v6.0

[Micah Morton]

On Tue, Aug 2, 2022 at 3:20 PM Linus Torvalds
<torvalds@linux-foundation.org> wrote:
>
> On Mon, Aug 1, 2022 at 7:40 PM Micah Morton <mortonm@chromium.org> wrote:
> >
> > This pull request contains one commit that touches common kernel code,
> >
> > one that adds functionality internal to the SafeSetID LSM code, and a
> >
> > few other commits that only modify the SafeSetID LSM selftest.
> [...]
>
> What odd MUA do you use that causes this double-spaced text email?
>
> I can read it, but it really is a bit strange. It was all plain text,
> and marked as utf-8, and otherwise looked normal except for that
> double spacing.
>
> I get flashbacks to my "writing papers at university" days.

I know, it was ugly. I just switched laptops to a Mac and thought for
sure the mail message preview I was seeing in gmail after copy+paste
from a terminal window was just some weird scaling issue on my
external monitor or something. Sure enough the message was sent off
looking like a double spaced book report from 8th grade :)

I'll have to find what's going wrong with the copy+paste to gmail on
this particular device.

>
>              Linus