Eric Lee / smarc-ti-linux-kernel

Download as
Browse Code ยป

Commit 00fcd1ceab6c42f7facfa0168b207fe70ee198c2

Authored by Eric W. Biederman
Committed by Greg Kroah-Hartman
1 parent 5f20adeafc
Exists in smarc-ti-linux-3.14.y and in 1 other branch processor-sdk-linux-01.00.00

groups: Consolidate the setgroups permission checks 

commit 7ff4d90b4c24a03666f296c3d4878cd39001e81e upstream.

Today there are 3 instances of setgroups and due to an oversight their
permission checking has diverged.  Add a common function so that
they may all share the same permission checking code.

This corrects the current oversight in the current permission checks
and adds a helper to avoid this in the future.

A user namespace security fix will update this new helper, shortly.

Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Showing 4 changed files with 11 additions and 3 deletions Side-by-side Diff

arch/s390/kernel/compat_linux.c
Diff comments   View file @ 00fcd1c
... ... @@ -245,7 +245,7 @@
245 245 struct group_info *group_info;
246 246 int retval;
247 247  
248   - if (!capable(CAP_SETGID))
  248 + if (!may_setgroups())
249 249 return -EPERM;
250 250 if ((unsigned)gidsetsize > NGROUPS_MAX)
251 251 return -EINVAL;
include/linux/cred.h
Diff comments   View file @ 00fcd1c
... ... @@ -68,6 +68,7 @@
68 68 extern int set_current_groups(struct group_info *);
69 69 extern int set_groups(struct cred *, struct group_info *);
70 70 extern int groups_search(const struct group_info *, kgid_t);
  71 +extern bool may_setgroups(void);
71 72  
72 73 /* access the groups "array" with this macro */
73 74 #define GROUP_AT(gi, i) \
... ... @@ -223,6 +223,13 @@
223 223 return i;
224 224 }
225 225  
  226 +bool may_setgroups(void)
  227 +{
  228 + struct user_namespace *user_ns = current_user_ns();
  229 +
  230 + return ns_capable(user_ns, CAP_SETGID);
  231 +}
  232 +
226 233 /*
227 234 * SMP: Our groups are copy-on-write. We can set them safely
228 235 * without another task interfering.
... ... @@ -233,7 +240,7 @@
233 240 struct group_info *group_info;
234 241 int retval;
235 242  
236   - if (!ns_capable(current_user_ns(), CAP_SETGID))
  243 + if (!may_setgroups())
237 244 return -EPERM;
238 245 if ((unsigned)gidsetsize > NGROUPS_MAX)
239 246 return -EINVAL;
... ... @@ -176,7 +176,7 @@
176 176 struct group_info *group_info;
177 177 int retval;
178 178  
179   - if (!ns_capable(current_user_ns(), CAP_SETGID))
  179 + if (!may_setgroups())
180 180 return -EPERM;
181 181 if ((unsigned)gidsetsize > NGROUPS_MAX)
182 182 return -EINVAL;