Commit e726c9a0a24b1381b2714dbeca322ab446fccb4a
Committed by
Greg Kroah-Hartman
1 parent
462c8c0b35
groups: Consolidate the setgroups permission checks
commit 7ff4d90b4c24a03666f296c3d4878cd39001e81e upstream. Today there are 3 instances of setgroups and due to an oversight their permission checking has diverged. Add a common function so that they may all share the same permission checking code. This corrects the current oversight in the current permission checks and adds a helper to avoid this in the future. A user namespace security fix will update this new helper, shortly. Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Showing 4 changed files with 11 additions and 3 deletions Side-by-side Diff
arch/s390/kernel/compat_linux.c
include/linux/cred.h
... | ... | @@ -68,6 +68,7 @@ |
68 | 68 | extern int set_current_groups(struct group_info *); |
69 | 69 | extern void set_groups(struct cred *, struct group_info *); |
70 | 70 | extern int groups_search(const struct group_info *, kgid_t); |
71 | +extern bool may_setgroups(void); | |
71 | 72 | |
72 | 73 | /* access the groups "array" with this macro */ |
73 | 74 | #define GROUP_AT(gi, i) \ |
kernel/groups.c
... | ... | @@ -213,6 +213,13 @@ |
213 | 213 | return i; |
214 | 214 | } |
215 | 215 | |
216 | +bool may_setgroups(void) | |
217 | +{ | |
218 | + struct user_namespace *user_ns = current_user_ns(); | |
219 | + | |
220 | + return ns_capable(user_ns, CAP_SETGID); | |
221 | +} | |
222 | + | |
216 | 223 | /* |
217 | 224 | * SMP: Our groups are copy-on-write. We can set them safely |
218 | 225 | * without another task interfering. |
... | ... | @@ -223,7 +230,7 @@ |
223 | 230 | struct group_info *group_info; |
224 | 231 | int retval; |
225 | 232 | |
226 | - if (!ns_capable(current_user_ns(), CAP_SETGID)) | |
233 | + if (!may_setgroups()) | |
227 | 234 | return -EPERM; |
228 | 235 | if ((unsigned)gidsetsize > NGROUPS_MAX) |
229 | 236 | return -EINVAL; |
kernel/uid16.c