From: "Serge E. Hallyn" <serge@hallyn.com>
To: "Christian Göttsche" <cgzones@googlemail.com>
Cc: selinux@vger.kernel.org, Serge Hallyn <serge@hallyn.com>,
linux-security-module@vger.kernel.org,
linux-kernel@vger.kernel.org
Subject: Re: [PATCH v2 1/8] capability: add capable_or to test for multiple caps with exactly one audit message
Date: Mon, 9 May 2022 12:12:39 -0500 [thread overview]
Message-ID: <20220509171239.GA28406@mail.hallyn.com> (raw)
In-Reply-To: <20220502160030.131168-8-cgzones@googlemail.com>
On Mon, May 02, 2022 at 06:00:30PM +0200, Christian Göttsche wrote:
> Add the interface `capable_or()` as an alternative to or multiple
How about 'capable_contains_oneof(x, y)' or 'capable_of_one(a, b)'?
> `capable()` calls, like `capable_or(CAP_SYS_NICE, CAP_SYS_ADMIN)`
> instead of `capable(CAP_SYS_NICE) || capable(CAP_SYS_ADMIN)`.
> `capable_or()` will in particular generate exactly one audit message,
> either for the left most capability in effect or, if the task has none,
> the first one.
> This is especially helpful with regard to SELinux, where each audit
> message about a not allowed capability will create an avc denial.
> Using this function with the least invasive capability as left most
> argument (e.g. CAP_SYS_NICE before CAP_SYS_ADMIN) enables policy writers
> to only allow the least invasive one and SELinux domains pass this check
> with only capability:sys_nice or capability:sys_admin allowed without
> any avc denial message.
>
> Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
>
> ---
> v2:
> avoid varargs and fix to two capabilities; capable_or3() can be added
> later if needed
> ---
> include/linux/capability.h | 5 +++++
> kernel/capability.c | 29 +++++++++++++++++++++++++++++
> 2 files changed, 34 insertions(+)
>
> diff --git a/include/linux/capability.h b/include/linux/capability.h
> index 65efb74c3585..a16d1edea9b3 100644
> --- a/include/linux/capability.h
> +++ b/include/linux/capability.h
> @@ -207,6 +207,7 @@ extern bool has_ns_capability(struct task_struct *t,
> extern bool has_capability_noaudit(struct task_struct *t, int cap);
> extern bool has_ns_capability_noaudit(struct task_struct *t,
> struct user_namespace *ns, int cap);
> +extern bool capable_or(int cap1, int cap2);
> extern bool capable(int cap);
> extern bool ns_capable(struct user_namespace *ns, int cap);
> extern bool ns_capable_noaudit(struct user_namespace *ns, int cap);
> @@ -230,6 +231,10 @@ static inline bool has_ns_capability_noaudit(struct task_struct *t,
> {
> return true;
> }
> +static inline bool capable_or(int cap1, int cap2)
> +{
> + return true;
> +}
> static inline bool capable(int cap)
> {
> return true;
> diff --git a/kernel/capability.c b/kernel/capability.c
> index 765194f5d678..cd8f3efe6d08 100644
> --- a/kernel/capability.c
> +++ b/kernel/capability.c
> @@ -435,6 +435,35 @@ bool ns_capable_setid(struct user_namespace *ns, int cap)
> }
> EXPORT_SYMBOL(ns_capable_setid);
>
> +/**
> + * capable_or - Determine if the current task has one of two superior capabilities in effect
> + * @cap1: The capabilities to be tested for first
> + * @cap2: The capabilities to be tested for secondly
> + *
> + * Return true if the current task has at one of the two given superior
s/has at one/has at least one/ ?
> + * capabilities currently available for use, false if not.
> + *
> + * In contrast to or'ing capable() this call will create exactly one audit
> + * message, either for @cap1, if it is granted or both are not permitted,
> + * or @cap2, if it is granted while the other one is not.
> + *
> + * The capabilities should be ordered from least to most invasive, i.e. CAP_SYS_ADMIN last.
> + *
> + * This sets PF_SUPERPRIV on the task if the capability is available on the
> + * assumption that it's about to be used.
> + */
> +bool capable_or(int cap1, int cap2)
> +{
> + if (ns_capable_noaudit(&init_user_ns, cap1))
> + return ns_capable(&init_user_ns, cap1);
> +
> + if (ns_capable_noaudit(&init_user_ns, cap2))
> + return ns_capable(&init_user_ns, cap2);
> +
> + return ns_capable(&init_user_ns, cap1);
Hm, too bad about the repetition of work, but I guess it has to be
this way right now.
> +}
> +EXPORT_SYMBOL(capable_or);
> +
> /**
> * capable - Determine if the current task has a superior capability in effect
> * @cap: The capability to be tested for
> --
> 2.36.0
next prev parent reply other threads:[~2022-05-09 17:18 UTC|newest]
Thread overview: 33+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-02-17 14:49 [RFC PATCH 2/2] capability: use new capable_or functionality Christian Göttsche
2022-02-17 14:49 ` [RFC PATCH 1/2] capability: add capable_or to test for multiple caps with exactly one audit message Christian Göttsche
2022-05-02 16:00 ` [PATCH v2 2/8] capability: use new capable_or functionality Christian Göttsche
2022-05-02 16:00 ` [PATCH v2 3/8] block: " Christian Göttsche
2022-05-02 16:00 ` [PATCH v2 4/8] drivers: " Christian Göttsche
2022-05-09 10:44 ` Jiri Slaby
2022-05-09 10:46 ` Hans Verkuil
2022-05-02 16:00 ` [PATCH v2 5/8] fs: " Christian Göttsche
2022-05-02 16:00 ` [PATCH v2 6/8] kernel: " Christian Göttsche
2022-05-02 16:00 ` [PATCH v2 7/8] kernel/bpf: " Christian Göttsche
2022-05-02 16:00 ` [PATCH v2 8/8] net: " Christian Göttsche
2022-05-09 17:15 ` Serge E. Hallyn
2022-05-22 17:33 ` Serge E. Hallyn
2022-05-02 16:00 ` [PATCH v2 1/8] capability: add capable_or to test for multiple caps with exactly one audit message Christian Göttsche
2022-05-09 17:12 ` Serge E. Hallyn [this message]
2022-06-15 15:26 ` [PATCH v3 2/8] capability: use new capable_any functionality Christian Göttsche
2022-06-15 15:26 ` [PATCH v3 3/8] block: " Christian Göttsche
2022-06-16 3:00 ` Bart Van Assche
2022-06-15 15:26 ` [PATCH v3 4/8] drivers: " Christian Göttsche
2022-06-15 15:45 ` Laurent Pinchart
2022-06-15 15:26 ` [PATCH v3 5/8] fs: " Christian Göttsche
2022-06-28 12:56 ` Christian Brauner
2022-06-28 14:11 ` Christian Göttsche
2022-06-15 15:26 ` [PATCH v3 6/8] kernel: " Christian Göttsche
2022-06-15 15:26 ` [PATCH v3 7/8] bpf: " Christian Göttsche
2022-06-15 15:26 ` [PATCH v3 8/8] net: " Christian Göttsche
2022-06-15 15:26 ` [PATCH v3 1/8] capability: add any wrapper to test for multiple caps with exactly one audit message Christian Göttsche
2022-06-26 22:34 ` Serge E. Hallyn
2022-08-30 15:05 ` Christian Göttsche
2022-08-30 15:10 ` Paul Moore
2022-09-02 0:56 ` Paul Moore
2022-09-02 1:35 ` Paul Moore
2022-02-17 17:29 ` [RFC PATCH 2/2] capability: use new capable_or functionality Alexei Starovoitov
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220509171239.GA28406@mail.hallyn.com \
--to=serge@hallyn.com \
--cc=cgzones@googlemail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=selinux@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).