Doug / smarc-fsl-linux-kernel

Download as
Browse Code ยป

Commit c540521bba5d2f24bd2c0417157bfaf8b85e2eee

Authored by Andy Lutomirski
Committed by James Morris
1 parent 26c439d400
Exists in smarc-l5.0.0_1.0.0-ga and in 5 other branches imx_3.10.17_1.0.1_ga, imx_3.10.53_1.1.0_ga, imx_3.14.28_1.0.0_ga, smarc-imx_3.10.53_1.1.0_ga, smarc-imx_3.14.28_1.0.0_ga

security: Minor improvements to no_new_privs documentation 

The documentation didn't actually mention how to enable no_new_privs.
This also adds a note about possible interactions between
no_new_privs and LSMs (i.e. why teaching systemd to set no_new_privs
is not necessarily a good idea), and it references the new docs
from include/linux/prctl.h.

Suggested-by: Rob Landley <rob@landley.net>
Signed-off-by: Andy Lutomirski <luto@amacapital.net>
Acked-by: Kees Cook <keescook@chromium.org>
Signed-off-by: James Morris <james.l.morris@oracle.com>

Showing 2 changed files with 9 additions and 0 deletions Side-by-side Diff

Documentation/prctl/no_new_privs.txt
Diff comments   View file @ c540521
... ... @@ -25,6 +25,13 @@
25 25 add to the permitted set, and LSMs will not relax constraints after
26 26 execve.
27 27  
  28 +To set no_new_privs, use prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0).
  29 +
  30 +Be careful, though: LSMs might also not tighten constraints on exec
  31 +in no_new_privs mode. (This means that setting up a general-purpose
  32 +service launcher to set no_new_privs before execing daemons may
  33 +interfere with LSM-based sandboxing.)
  34 +
28 35 Note that no_new_privs does not prevent privilege changes that do not
29 36 involve execve. An appropriately privileged task can still call
30 37 setuid(2) and receive SCM_RIGHTS datagrams.
include/linux/prctl.h
Diff comments   View file @ c540521
... ... @@ -141,6 +141,8 @@
141 141 * Changing LSM security domain is considered a new privilege. So, for example,
142 142 * asking selinux for a specific new context (e.g. with runcon) will result
143 143 * in execve returning -EPERM.
  144 + *
  145 + * See Documentation/prctl/no_new_privs.txt for more details.
144 146 */
145 147 #define PR_SET_NO_NEW_PRIVS 38
146 148 #define PR_GET_NO_NEW_PRIVS 39