From: Jan Engelhardt <jengelh@computergmbh.de>
To: Alexander Wuerstlein <arw@arw.name>
Cc: linux-kernel@vger.kernel.org,
Johannes Schlumberger <spjsschl@stud.informatik.uni-erlangen.de>
Subject: Re: [PATCH] Check files' signatures before doing suid/sgid [2/4]
Date: Sat, 23 Jun 2007 19:54:39 +0200 (CEST) [thread overview]
Message-ID: <Pine.LNX.4.64.0706231954190.11964@fbirervta.pbzchgretzou.qr> (raw)
In-Reply-To: <1182536729847-git-send-email-arw@arw.name>
On Jun 22 2007 20:25, Alexander Wuerstlein wrote:
>+#ifdef CONFIG_SNS_SIGNED
>+#include <linux/sns.h>
>+#endif
>
> #include <asm/uaccess.h>
> #include <asm/mmu_context.h>
>@@ -928,13 +931,21 @@ int prepare_binprm(struct linux_binprm *bprm)
> mode = inode->i_mode;
> if (bprm->file->f_op == NULL)
> return -EACCES;
>+#ifdef CONFIG_SNS_SIGNED
>+ if (mode & S_ISUID)
>+ current->sns_valid_sig = sns_signature_valid(bprm->file);
>+#endif
>
> bprm->e_uid = current->euid;
> bprm->e_gid = current->egid;
>
> if(!(bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID)) {
> /* Set-uid? */
>- if (mode & S_ISUID) {
>+#ifdef CONFIG_SNS_SIGNED_SETUID
>+ if (mode & S_ISUID && current->sns_valid_sig) {
>+#else
>+ if (mode & S_ISUID) {
>+#endif /*SNS_SIGNED_SETUID*/
> current->personality &= ~PER_CLEAR_ON_SETID;
> bprm->e_uid = inode->i_uid;
> }
>@@ -945,7 +956,11 @@ int prepare_binprm(struct linux_binprm *bprm)
> * is a candidate for mandatory locking, not a setgid
> * executable.
> */
>- if ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP)) {
>+#ifdef CONFIG_SNS_SIGNED_SETGID
>+ if ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP) && current->sns_valid_sig) {
>+#else
>+ if ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP)) {
>+#endif /*SNS_SIGNED_SETGID*/
> current->personality &= ~PER_CLEAR_ON_SETID;
> bprm->e_gid = inode->i_gid;
> }
...
That's a lot of unwanted ifdefs!
Jan
--
next prev parent reply other threads:[~2007-06-23 17:54 UTC|newest]
Thread overview: 26+ messages / expand[flat|nested] mbox.gz Atom feed top
2007-06-21 15:55 [PATCH] signed binaries support [0/4] Johannes Schlumberger
2007-06-21 16:17 ` Adrian Bunk
2007-06-21 16:29 ` Alexander Wuerstlein
2007-06-21 17:23 ` Adrian Bunk
2007-06-21 17:34 ` Alexander Wuerstlein
2007-06-21 18:05 ` Adrian Bunk
2007-06-21 18:21 ` Johannes Schlumberger
2007-06-22 18:25 ` [PATCH] export xattr_resolve_name_sns [1/4] Alexander Wuerstlein
2007-06-22 18:25 ` [PATCH] Check files' signatures before doing suid/sgid [2/4] Alexander Wuerstlein
2007-06-22 19:36 ` Satyam Sharma
2007-06-24 22:58 ` Alexander Wuerstlein
2007-06-25 23:53 ` Satyam Sharma
2007-06-26 0:27 ` Alexander Wuerstlein
2007-06-26 2:13 ` Satyam Sharma
2007-06-23 17:54 ` Jan Engelhardt [this message]
2007-06-22 18:25 ` [PATCH] sns: check related executable memory of binaries [3/4] Alexander Wuerstlein
2007-06-22 18:25 ` [PATCH] sns: add syscall to check signed state of a process [4/4] Alexander Wuerstlein
2007-06-21 16:02 [PATCH] Check files' signatures before doing suid/sgid [2/4] Alexander Wuerstlein
2007-06-21 17:17 ` Arjan van de Ven
2007-06-21 17:25 ` Alexander Wuerstlein
2007-06-21 17:29 ` Arjan van de Ven
2007-06-21 17:46 ` Alexander Wuerstlein
2007-06-21 18:49 ` Arjan van de Ven
2007-06-21 21:40 ` Johannes Schlumberger
2007-06-23 18:01 ` Jan Engelhardt
2007-06-25 10:54 ` Johannes Schlumberger
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=Pine.LNX.4.64.0706231954190.11964@fbirervta.pbzchgretzou.qr \
--to=jengelh@computergmbh.de \
--cc=arw@arw.name \
--cc=linux-kernel@vger.kernel.org \
--cc=spjsschl@stud.informatik.uni-erlangen.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).