(no subject)

[Chris Wright]

Bcc: chris@wirex.com
Subject: Re: [PATCH][LSM] Early init for security modules 1/4
Reply-To: 
In-Reply-To: <20030613000409.B31636@figure1.int.wirex.com>; from chris@wirex.com on Fri, Jun 13, 2003 at 12:04:09AM -0700

[LSM] early init for security modules.  As discussed before, this allows
for early initialization of security modules when compiled statically
into the kernel.  The standard do_initcalls is too late for complete
coverage of all filesystems and threads, for example.

--- linus-2.5/arch/alpha/vmlinux.lds.S.early_init	Wed Apr  2 00:42:56 2003
+++ linus-2.5/arch/alpha/vmlinux.lds.S	Thu Jun 12 00:40:04 2003
@@ -74,6 +74,9 @@
 	__con_initcall_end = .;
   }
 
+  . = ALIGN(8);
+  SECURITY_INIT
+
   . = ALIGN(64);
   __per_cpu_start = .;
   .data.percpu : { *(.data.percpu) }
--- linus-2.5/arch/arm/vmlinux-armo.lds.in.early_init	Wed Apr  2 00:42:56 2003
+++ linus-2.5/arch/arm/vmlinux-armo.lds.in	Thu Jun 12 00:40:04 2003
@@ -43,6 +43,7 @@
 		__con_initcall_start = .;
 			*(.con_initcall.init)
 		__con_initcall_end = .;
+		SECURITY_INIT
 		. = ALIGN(32768);
 		__init_end = .;
 	}
--- linus-2.5/arch/arm/vmlinux-armv.lds.in.early_init	Sun Apr 27 08:35:24 2003
+++ linus-2.5/arch/arm/vmlinux-armv.lds.in	Thu Jun 12 00:40:04 2003
@@ -53,6 +53,7 @@
 		__con_initcall_start = .;
 			*(.con_initcall.init)
 		__con_initcall_end = .;
+		SECURITY_INIT
 		. = ALIGN(32);
 		__initramfs_start = .;
 			usr/built-in.o(.init.ramfs)
--- linus-2.5/arch/cris/vmlinux.lds.S.early_init	Fri Feb 14 14:37:05 2003
+++ linus-2.5/arch/cris/vmlinux.lds.S	Thu Jun 12 22:41:51 2003
@@ -74,7 +74,12 @@
 		__con_initcall_start = .;
 		*(.con_initcall.init)
 		__con_initcall_end = .;
-	
+	}
+	.security_initcall.init : {
+		__security_initcall_start = .;
+		*(.security_initcall.init)
+		__security_initcall_end = .;
+
 		/* We fill to the next page, so we can discard all init
 		   pages without needing to consider what payload might be
 		   appended to the kernel image.  */
--- linus-2.5/arch/h8300/platform/h8300h/generic/rom.ld.early_init	Thu Apr 17 12:30:45 2003
+++ linus-2.5/arch/h8300/platform/h8300h/generic/rom.ld	Thu Jun 12 00:40:05 2003
@@ -83,6 +83,7 @@
 	___con_initcall_start = .;
 		*(.con_initcall.init)
 	___con_initcall_end = .;
+	SECURITY_INIT
 		. = ALIGN(4);
 	___initramfs_start = .;
   		*(.init.ramfs)
--- linus-2.5/arch/i386/vmlinux.lds.S.early_init	Tue May  6 06:54:06 2003
+++ linus-2.5/arch/i386/vmlinux.lds.S	Thu Jun 12 00:40:05 2003
@@ -81,6 +81,7 @@
   __con_initcall_start = .;
   .con_initcall.init : { *(.con_initcall.init) }
   __con_initcall_end = .;
+  SECURITY_INIT
   . = ALIGN(4);
   __alt_instructions = .;
   .altinstructions : { *(.altinstructions) } 
--- linus-2.5/arch/ia64/vmlinux.lds.S.early_init	Wed Apr  2 00:42:56 2003
+++ linus-2.5/arch/ia64/vmlinux.lds.S	Thu Jun 12 00:40:05 2003
@@ -141,6 +141,10 @@
   .con_initcall.init : AT(ADDR(.con_initcall.init) - PAGE_OFFSET)
 	{ *(.con_initcall.init) }
   __con_initcall_end = .;
+  __security_initcall_start = .;
+  .security_initcall.init : AT(ADDR(.security_initcall.init) - PAGE_OFFSET)
+	{ *(.security_initcall.init) }
+  __security_initcall_end = .;
   . = ALIGN(PAGE_SIZE);
   __init_end = .;
 
--- linus-2.5/arch/m68k/vmlinux-std.lds.early_init Wed Apr  2 00:42:56 2003
+++ linus-2.5/arch/m68k/vmlinux-std.lds	Thu Jun 12 00:40:05 2003
@@ -67,6 +67,7 @@
   __con_initcall_start = .;
   .con_initcall.init : { *(.con_initcall.init) }
   __con_initcall_end = .;
+  SECURITY_INIT
   . = ALIGN(8192);
   __initramfs_start = .;
   .init.ramfs : { *(.init.ramfs) }
--- linus-2.5/arch/m68k/vmlinux-sun3.lds.early_init	Wed Apr  2 00:42:56 2003
+++ linus-2.5/arch/m68k/vmlinux-sun3.lds	Thu Jun 12 00:40:05 2003
@@ -61,6 +61,7 @@
 	__con_initcall_start = .;
 	.con_initcall.init : { *(.con_initcall.init) }
 	__con_initcall_end = .;
+	SECURITY_INIT
 	. = ALIGN(8192);
 	__initramfs_start = .;
 	.init.ramfs : { *(.init.ramfs) }
--- linus-2.5/arch/m68knommu/vmlinux.lds.S.early_init	Tue May 27 20:13:11 2003
+++ linus-2.5/arch/m68knommu/vmlinux.lds.S	Thu Jun 12 00:40:05 2003
@@ -277,9 +277,7 @@
 		__con_initcall_start = .;
 		*(.con_initcall.init)
 		__con_initcall_end = .;
-		__security_initcall_start = .;
-		*(.security_initcall.init)
-		__security_initcall_end = .;
+		SECURITY_INIT
 		. = ALIGN(4);
 		__initramfs_start = .;
 		*(.init.ramfs)
--- linus-2.5/arch/mips/vmlinux.lds.S.early_init	Fri Feb 14 15:09:55 2003
+++ linus-2.5/arch/mips/vmlinux.lds.S	Thu Jun 12 00:40:06 2003
@@ -54,6 +54,7 @@
   __con_initcall_start = .;
   .con_initcall.init : { *(.con_initcall.init) }
   __con_initcall_end = .;
+  SECURITY_INIT
   . = ALIGN(4096);	/* Align double page for init_task_union */
   __init_end = .;
 
--- linus-2.5/arch/mips64/vmlinux.lds.S.early_init	Fri Feb 14 15:10:00 2003
+++ linus-2.5/arch/mips64/vmlinux.lds.S	Thu Jun 12 00:40:06 2003
@@ -53,6 +53,7 @@
   __con_initcall_start = .;
   .con_initcall.init : { *(.con_initcall.init) }
   __con_initcall_end = .;
+  SECURITY_INIT
   . = ALIGN(4096);	/* Align double page for init_task_union */
   __init_end = .;
 
--- linus-2.5/arch/parisc/vmlinux.lds.S.early_init	Wed Apr  2 00:42:56 2003
+++ linus-2.5/arch/parisc/vmlinux.lds.S	Thu Jun 12 00:40:06 2003
@@ -80,6 +80,7 @@
   __con_initcall_start = .;
   .con_initcall.init : { *(.con_initcall.init) }
   __con_initcall_end = .;
+  SECURITY_INIT
   . = ALIGN(4096);
   __initramfs_start = .;
   .init.ramfs : { *(.init.ramfs) }
--- linus-2.5/arch/ppc/vmlinux.lds.S.early_init	Mon May 26 04:58:49 2003
+++ linus-2.5/arch/ppc/vmlinux.lds.S	Thu Jun 12 00:40:06 2003
@@ -119,6 +119,8 @@
   .con_initcall.init : { *(.con_initcall.init) }
   __con_initcall_end = .;
 
+  SECURITY_INIT
+
   __start___ftr_fixup = .;
   __ftr_fixup : { *(__ftr_fixup) }
   __stop___ftr_fixup = .;
--- linus-2.5/arch/ppc64/vmlinux.lds.S.early_init	Wed Apr  2 00:42:56 2003
+++ linus-2.5/arch/ppc64/vmlinux.lds.S	Thu Jun 12 00:40:07 2003
@@ -104,6 +104,7 @@
   __con_initcall_start = .;
   .con_initcall.init : { *(.con_initcall.init) }
   __con_initcall_end = .;
+  SECURITY_INIT
   . = ALIGN(4096);
   __initramfs_start = .;
   .init.ramfs : { *(.init.ramfs) }
--- linus-2.5/arch/s390/vmlinux.lds.S.early_init	Mon May 26 12:20:42 2003
+++ linus-2.5/arch/s390/vmlinux.lds.S	Thu Jun 12 00:40:07 2003
@@ -94,6 +94,7 @@
   __con_initcall_start = .;
   .con_initcall.init : { *(.con_initcall.init) }
   __con_initcall_end = .;
+  SECURITY_INIT
   . = ALIGN(256);
   __initramfs_start = .;
   .init.ramfs : { *(.init.initramfs) }
--- linus-2.5/arch/sh/vmlinux.lds.S.early_init	Fri Feb 14 15:11:24 2003
+++ linus-2.5/arch/sh/vmlinux.lds.S	Thu Jun 12 00:40:08 2003
@@ -71,6 +71,7 @@
   __con_initcall_start = .;
   .con_initcall.init : { *(.con_initcall.init) }
   __con_initcall_end = .;
+  SECURITY_INIT
   __machvec_start = .;
   .machvec.init : { *(.machvec.init) }
   __machvec_end = .;
--- linus-2.5/arch/sparc/vmlinux.lds.S.early_init	Wed Apr  2 00:42:56 2003
+++ linus-2.5/arch/sparc/vmlinux.lds.S	Thu Jun 12 00:40:09 2003
@@ -62,6 +62,7 @@
   __con_initcall_start = .;
   .con_initcall.init : { *(.con_initcall.init) }
   __con_initcall_end = .;
+  SECURITY_INIT
   . = ALIGN(4096);
   __initramfs_start = .;
   .init.ramfs : { *(.init.ramfs) }
--- linus-2.5/arch/sparc64/vmlinux.lds.S.early_init	Wed Apr  2 00:42:56 2003
+++ linus-2.5/arch/sparc64/vmlinux.lds.S	Thu Jun 12 00:40:09 2003
@@ -68,6 +68,7 @@
   __con_initcall_start = .;
   .con_initcall.init : { *(.con_initcall.init) }
   __con_initcall_end = .;
+  SECURITY_INIT
   . = ALIGN(8192); 
   __initramfs_start = .;
   .init.ramfs : { *(.init.ramfs) }
--- linus-2.5/arch/x86_64/vmlinux.lds.S.early_init	Fri May 23 03:56:33 2003
+++ linus-2.5/arch/x86_64/vmlinux.lds.S	Thu Jun 12 00:40:10 2003
@@ -105,6 +105,7 @@
   __con_initcall_start = .;
   .con_initcall.init : { *(.con_initcall.init) }
   __con_initcall_end = .;
+  SECURITY_INIT
   . = ALIGN(4096);
   __initramfs_start = .;
   .init.ramfs : { *(.init.ramfs) }
--- linus-2.5/include/asm-generic/vmlinux.lds.h.early_init	Mon Feb  3 13:00:30 2003
+++ linus-2.5/include/asm-generic/vmlinux.lds.h	Thu Jun 12 00:40:10 2003
@@ -45,3 +45,9 @@
 		*(__ksymtab_strings)					\
 	}
 
+#define SECURITY_INIT							\
+	.security_initcall.init : {					\
+		__security_initcall_start = .;				\
+		*(.security_initcall.init) 				\
+		__security_initcall_end = .;				\
+	}
--- linus-2.5/include/linux/init.h.early_init	Mon Mar  3 13:05:26 2003
+++ linus-2.5/include/linux/init.h	Thu Jun 12 00:40:10 2003
@@ -64,6 +64,7 @@
 typedef void (*exitcall_t)(void);
 
 extern initcall_t __con_initcall_start, __con_initcall_end;
+extern initcall_t __security_initcall_start, __security_initcall_end;
 #endif
   
 #ifndef MODULE
@@ -96,6 +97,9 @@
 #define console_initcall(fn) \
 	static initcall_t __initcall_##fn __attribute__ ((unused,__section__ (".con_initcall.init")))=fn
 
+#define security_initcall(fn) \
+	static initcall_t __initcall_##fn __attribute__ ((unused,__section__ (".security_initcall.init"))) = fn
+
 struct obs_kernel_param {
 	const char *str;
 	int (*setup_func)(char *);
@@ -142,6 +146,8 @@
 #define fs_initcall(fn)			module_init(fn)
 #define device_initcall(fn)		module_init(fn)
 #define late_initcall(fn)		module_init(fn)
+
+#define security_initcall(fn)		module_init(fn)
 
 /* These macros create a dummy inline: gcc 2.9x does not count alias
  as usage, hence the `unused function' warning when __init functions
--- linus-2.5/init/main.c.early_init	Fri Jun  6 17:30:07 2003
+++ linus-2.5/init/main.c	Thu Jun 12 00:40:11 2003
@@ -439,8 +439,8 @@
 	pte_chain_init();
 	fork_init(num_physpages);
 	proc_caches_init();
-	security_scaffolding_startup();
 	buffer_init();
+	security_scaffolding_startup();
 	vfs_caches_init(num_physpages);
 	radix_tree_init();
 	signals_init();
--- linus-2.5/security/capability.c.early_init	Mon Feb 17 12:08:10 2003
+++ linus-2.5/security/capability.c	Thu Jun 12 00:40:11 2003
@@ -348,7 +348,7 @@
 	}
 }
 
-module_init (capability_init);
+security_initcall (capability_init);
 module_exit (capability_exit);
 
 MODULE_DESCRIPTION("Standard Linux Capabilities Security Module");
--- linus-2.5/security/root_plug.c.early_init	Mon Jun  2 03:37:38 2003
+++ linus-2.5/security/root_plug.c	Thu Jun 12 00:40:12 2003
@@ -135,7 +135,7 @@
 	printk (KERN_INFO "Root Plug module removed\n");
 }
 
-module_init (rootplug_init);
+security_initcall (rootplug_init);
 module_exit (rootplug_exit);
 
 MODULE_DESCRIPTION("Root Plug sample LSM module, written for Linux Journal article");
--- linus-2.5/security/security.c.early_init	Wed Dec 18 15:10:17 2002
+++ linus-2.5/security/security.c	Thu Jun 12 00:40:12 2003
@@ -38,12 +38,22 @@
 	return 0;
 }
 
+static void __init do_security_initcalls(void)
+{
+	initcall_t *call;
+	call = &__security_initcall_start;
+	while (call < &__security_initcall_end) {
+		(*call)();
+		call++;
+	}
+}
+
 /**
  * security_scaffolding_startup - initialzes the security scaffolding framework
  *
  * This should be called early in the kernel initialization sequence.
  */
-int security_scaffolding_startup (void)
+int __init security_scaffolding_startup (void)
 {
 	printk (KERN_INFO "Security Scaffold v" SECURITY_SCAFFOLD_VERSION
 		" initialized\n");
@@ -55,6 +65,7 @@
 	}
 
 	security_ops = &dummy_security_ops;
+	do_security_initcalls();
 
 	return 0;
 }

Re: [PATCH][LSM] Remove task_kmod_set_label hook 2/4

[Chris Wright]

[LSM] Remove task_kmod_set_label hook, it is no longer necessary.
kmod is now handled by keventd which already does reparent_to_init,
so there is no need to worry about getting the security labels right
for code running off the keventd workqueue.

--- linus-2.5/include/linux/security.h.kmod	Thu Jun 12 22:48:12 2003
+++ linus-2.5/include/linux/security.h	Thu Jun 12 22:48:12 2003
@@ -46,7 +46,6 @@
 extern int cap_bprm_set_security (struct linux_binprm *bprm);
 extern void cap_bprm_compute_creds (struct linux_binprm *bprm);
 extern int cap_task_post_setuid (uid_t old_ruid, uid_t old_euid, uid_t old_suid, int flags);
-extern void cap_task_kmod_set_label (void);
 extern void cap_task_reparent_to_init (struct task_struct *p);
 extern int cap_syslog (int type);
 
@@ -607,10 +606,6 @@
  *	@arg4 contains a argument.
  *	@arg5 contains a argument.
  *	Return 0 if permission is granted.
- * @task_kmod_set_label:
- *	Set the security attributes in current->security for the kernel module
- *	loader thread, so that it has the permissions needed to perform its
- *	function.
  * @task_reparent_to_init:
  * 	Set the security attributes in @p->security for a kernel thread that
  * 	is being reparented to the init task.
@@ -1111,7 +1106,6 @@
 	int (*task_prctl) (int option, unsigned long arg2,
 			   unsigned long arg3, unsigned long arg4,
 			   unsigned long arg5);
-	void (*task_kmod_set_label) (void);
 	void (*task_reparent_to_init) (struct task_struct * p);
 	void (*task_to_inode)(struct task_struct *p, struct inode *inode);
 
@@ -1692,11 +1686,6 @@
 	return security_ops->task_prctl (option, arg2, arg3, arg4, arg5);
 }
 
-static inline void security_task_kmod_set_label (void)
-{
-	security_ops->task_kmod_set_label ();
-}
-
 static inline void security_task_reparent_to_init (struct task_struct *p)
 {
 	security_ops->task_reparent_to_init (p);
@@ -2321,11 +2310,6 @@
 	return 0;
 }
 
-static inline void security_task_kmod_set_label (void)
-{
-	cap_task_kmod_set_label ();
-}
-
 static inline void security_task_reparent_to_init (struct task_struct *p)
 {
 	cap_task_reparent_to_init (p);
--- linus-2.5/security/capability.c.kmod	Thu Jun 12 00:40:11 2003
+++ linus-2.5/security/capability.c	Thu Jun 12 22:48:12 2003
@@ -248,12 +248,6 @@
 	return 0;
 }
 
-void cap_task_kmod_set_label (void)
-{
-	cap_set_full (current->cap_effective);
-	return;
-}
-
 void cap_task_reparent_to_init (struct task_struct *p)
 {
 	p->cap_effective = CAP_INIT_EFF_SET;
@@ -278,7 +272,6 @@
 EXPORT_SYMBOL(cap_bprm_set_security);
 EXPORT_SYMBOL(cap_bprm_compute_creds);
 EXPORT_SYMBOL(cap_task_post_setuid);
-EXPORT_SYMBOL(cap_task_kmod_set_label);
 EXPORT_SYMBOL(cap_task_reparent_to_init);
 EXPORT_SYMBOL(cap_syslog);
 
@@ -298,7 +291,6 @@
 	.bprm_set_security =		cap_bprm_set_security,
 
 	.task_post_setuid =		cap_task_post_setuid,
-	.task_kmod_set_label =		cap_task_kmod_set_label,
 	.task_reparent_to_init =	cap_task_reparent_to_init,
 
 	.syslog =                       cap_syslog,
--- linus-2.5/security/dummy.c.kmod	Thu Jun 12 22:48:12 2003
+++ linus-2.5/security/dummy.c	Thu Jun 12 22:48:12 2003
@@ -517,11 +517,6 @@
 	return 0;
 }
 
-static void dummy_task_kmod_set_label (void)
-{
-	return;
-}
-
 static void dummy_task_reparent_to_init (struct task_struct *p)
 {
 	p->euid = p->fsuid = 0;
@@ -871,7 +866,6 @@
 	set_to_dummy_if_null(ops, task_wait);
 	set_to_dummy_if_null(ops, task_kill);
 	set_to_dummy_if_null(ops, task_prctl);
-	set_to_dummy_if_null(ops, task_kmod_set_label);
 	set_to_dummy_if_null(ops, task_reparent_to_init);
  	set_to_dummy_if_null(ops, task_to_inode);
 	set_to_dummy_if_null(ops, ipc_permission);
--- linus-2.5/security/root_plug.c.kmod	Thu Jun 12 00:40:12 2003
+++ linus-2.5/security/root_plug.c	Thu Jun 12 22:48:12 2003
@@ -94,7 +94,6 @@
 	.bprm_set_security =		cap_bprm_set_security,
 
 	.task_post_setuid =		cap_task_post_setuid,
-	.task_kmod_set_label =		cap_task_kmod_set_label,
 	.task_reparent_to_init =	cap_task_reparent_to_init,
 
 	.bprm_check_security =		rootplug_bprm_check_security,

Re: [PATCH][LSM] Remove inode_permission_lite hook 3/4

[Chris Wright]

[LSM] Remove security_inode_permission_lite hook

--- linus-2.5/fs/namei.c.perm_lite	Thu Jun 12 22:51:27 2003
+++ linus-2.5/fs/namei.c	Thu Jun 12 22:51:27 2003
@@ -325,7 +325,7 @@
 
 	return -EACCES;
 ok:
-	return security_inode_permission_lite(inode, MAY_EXEC);
+	return security_inode_permission(inode, MAY_EXEC);
 }
 
 /*
--- linus-2.5/include/linux/security.h.perm_lite	Thu Jun 12 22:48:12 2003
+++ linus-2.5/include/linux/security.h	Thu Jun 12 22:51:27 2003
@@ -327,16 +327,6 @@
  *	@inode contains the inode structure to check.
  *	@mask contains the permission mask.
  *	Return 0 if permission is granted.
- * @inode_permission_lite:
- * 	Check permission before accessing an inode.  This hook is
- * 	currently only called when checking MAY_EXEC access during
- * 	pathname resolution.  The dcache lock is held and thus modules
- * 	that could sleep or contend the lock should return -EAGAIN to
- * 	inform the kernel to drop the lock and try again calling the
- * 	full permission hook.
- * 	@inode contains the inode structure to check.
- * 	@mask contains the permission mask.
- * 	Return 0 if permission is granted.
  * @inode_setattr:
  *	Check permission before setting file attributes.  Note that the kernel
  *	call to notify_change is performed from several locations, whenever
@@ -1052,7 +1042,6 @@
 	int (*inode_readlink) (struct dentry *dentry);
 	int (*inode_follow_link) (struct dentry *dentry, struct nameidata *nd);
 	int (*inode_permission) (struct inode *inode, int mask);
-	int (*inode_permission_lite) (struct inode *inode, int mask);
 	int (*inode_setattr)	(struct dentry *dentry, struct iattr *attr);
 	int (*inode_getattr) (struct vfsmount *mnt, struct dentry *dentry);
         void (*inode_delete) (struct inode *inode);
@@ -1465,12 +1454,6 @@
 	return security_ops->inode_permission (inode, mask);
 }
 
-static inline int security_inode_permission_lite (struct inode *inode,
-						  int mask)
-{
-	return security_ops->inode_permission_lite (inode, mask);
-}
-
 static inline int security_inode_setattr (struct dentry *dentry,
 					  struct iattr *attr)
 {
@@ -2096,12 +2079,6 @@
 {
 	return 0;
 }
-
-static inline int security_inode_permission_lite (struct inode *inode,
-						  int mask)
-{
-	return 0;
-}
 
 static inline int security_inode_setattr (struct dentry *dentry,
 					  struct iattr *attr)
--- linus-2.5/security/dummy.c.perm_lite	Thu Jun 12 22:48:12 2003
+++ linus-2.5/security/dummy.c	Thu Jun 12 22:51:27 2003
@@ -308,11 +308,6 @@
 	return 0;
 }
 
-static int dummy_inode_permission_lite (struct inode *inode, int mask)
-{
-	return 0;
-}
-
 static int dummy_inode_setattr (struct dentry *dentry, struct iattr *iattr)
 {
 	return 0;
@@ -826,7 +821,6 @@
 	set_to_dummy_if_null(ops, inode_readlink);
 	set_to_dummy_if_null(ops, inode_follow_link);
 	set_to_dummy_if_null(ops, inode_permission);
-	set_to_dummy_if_null(ops, inode_permission_lite);
 	set_to_dummy_if_null(ops, inode_setattr);
 	set_to_dummy_if_null(ops, inode_getattr);
 	set_to_dummy_if_null(ops, inode_delete);

Re: [PATCH][LSM] setfsuid/setgsuid bug fix 4/4

[Chris Wright]

Patch from Jakub Jelínek <jakub@redhat.com>

[LSM] make sure setfsuid/setfsgid return values are right. Before
include/linux/security.h was added, setfsuid/setfsgid always returned
old_fsuid, no matter if the fsuid was actually changed or not.  With
the default security ops it seems to do the same, because both
security_task_setuid and security_task_post_setuid return 0, but
these are hooks which seem to return 0 on success, -errno on failure,
so if some non-default security hook is installed and ever returns
-errno in setfsuid/setfsgid, -errno will be returned from the syscall
instead of the expected old_fsuid. This makes it hard to distinguish
uids 0xfffff001 .. 0xffffffff from errors of security hooks.

--- linus-2.5/kernel/sys.c.setfsuid	Thu Jun 12 22:53:14 2003
+++ linus-2.5/kernel/sys.c	Thu Jun 12 22:53:14 2003
@@ -831,13 +831,11 @@
 asmlinkage long sys_setfsuid(uid_t uid)
 {
 	int old_fsuid;
-	int retval;
-
-	retval = security_task_setuid(uid, (uid_t)-1, (uid_t)-1, LSM_SETID_FS);
-	if (retval)
-		return retval;
 
 	old_fsuid = current->fsuid;
+	if (security_task_setuid(uid, (uid_t)-1, (uid_t)-1, LSM_SETID_FS))
+		return old_fsuid;
+
 	if (uid == current->uid || uid == current->euid ||
 	    uid == current->suid || uid == current->fsuid || 
 	    capable(CAP_SETUID))
@@ -850,9 +848,7 @@
 		current->fsuid = uid;
 	}
 
-	retval = security_task_post_setuid(old_fsuid, (uid_t)-1, (uid_t)-1, LSM_SETID_FS);
-	if (retval)
-		return retval;
+	security_task_post_setuid(old_fsuid, (uid_t)-1, (uid_t)-1, LSM_SETID_FS);
 
 	return old_fsuid;
 }
@@ -863,13 +859,11 @@
 asmlinkage long sys_setfsgid(gid_t gid)
 {
 	int old_fsgid;
-	int retval;
-
-	retval = security_task_setgid(gid, (gid_t)-1, (gid_t)-1, LSM_SETID_FS);
-	if (retval)
-		return retval;
 
 	old_fsgid = current->fsgid;
+	if (security_task_setgid(gid, (gid_t)-1, (gid_t)-1, LSM_SETID_FS))
+		return old_fsgid;
+
 	if (gid == current->gid || gid == current->egid ||
 	    gid == current->sgid || gid == current->fsgid || 
 	    capable(CAP_SETGID))

Re: [PATCH][LSM] Early init for security modules 1/4

[Chris Wright]

argh, sorry about the blank subject on that first patch.  typing too
quickly.

> [LSM] early init for security modules.  As discussed before, this allows
<snip>

thanks,
-chris
-- 
Linux Security Modules     http://lsm.immunix.org     http://lsm.bkbits.net