qiurui/linux-kernelorg-stable
1
0
Fork 0
mirror of https://kernel.googlesource.com/pub/scm/linux/kernel/git/stable/linux.git synced 2026-09-09 00:02:02 +08:00
Code Issues Packages Projects Releases Wiki Activity

ipc: don't audit capability check in ipc_permissions()

Browse Source 
[ Upstream commit 0715881360 ]

The IPC sysctls implement the ctl_table_root::permissions hook and
they override the file access mode based on the CAP_CHECKPOINT_RESTORE
capability, which is being checked regardless of whether any access is
actually denied or not, so if an LSM denies the capability, an audit
record may be logged even when access is in fact granted.

It wouldn't be viable to restructure the sysctl permission logic to only
check the capability when the access would be actually denied if it's
not granted. Thus, do the same as in net_ctl_permissions()
(net/sysctl_net.c) - switch from ns_capable() to ns_capable_noaudit(),
so that the check never emits an audit record.

Fixes: 0889f44e28 ("ipc: Check permissions for checkpoint_restart sysctls at open time")
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Acked-by: Alexey Gladkov <legion@kernel.org>
Acked-by: Serge Hallyn <serge@hallyn.com>
Signed-off-by: Serge Hallyn <sergeh@kernel.org>
Stable-dep-of: 8924336531 ("ipc: don't audit capability check in ipc_permissions()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Ondrej Mosnacek
2026-02-26 14:59:19 -08:00
committed by Greg Kroah-Hartman
parent f5efb397c8
commit 8fd58e0a0f
2 changed files with 7 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
include/linux/capability.h
+6
View File
@@ -203,6 +203,12 @@ static inline bool checkpoint_restore_ns_capable(struct user_namespace *ns)
ns_capable(ns, CAP_SYS_ADMIN);
}
static inline bool checkpoint_restore_ns_capable_noaudit(struct user_namespace *ns)
{
return ns_capable_noaudit(ns, CAP_CHECKPOINT_RESTORE) ||
ns_capable_noaudit(ns, CAP_SYS_ADMIN);
}
/* audit system wants to get cap info from files as well */
int get_vfs_caps_from_disk(struct mnt_idmap *idmap,
const struct dentry *dentry,
ipc/ipc_sysctl.c
+1 -1
View File
@@ -214,7 +214,7 @@ static int ipc_permissions(struct ctl_table_header *head, const struct ctl_table
if (((table->data == &ns->ids[IPC_SEM_IDS].next_id) ||
(table->data == &ns->ids[IPC_MSG_IDS].next_id) ||
(table->data == &ns->ids[IPC_SHM_IDS].next_id)) &&
checkpoint_restore_ns_capable(ns->user_ns))
checkpoint_restore_ns_capable_noaudit(ns->user_ns))
mode = 0666;
else
#endif