[PATCH v5 2/2] LSM: add SafeSetID module that gates setid calls

[James Morris]

On Wed, 16 Jan 2019, mortonm at chromium.org wrote:

> From: Micah Morton <mortonm at chromium.org>
> 
> SafeSetID gates the setid family of syscalls to restrict UID/GID
> transitions from a given UID/GID to only those approved by a
> system-wide whitelist. These restrictions also prohibit the given
> UIDs/GIDs from obtaining auxiliary privileges associated with
> CAP_SET{U/G}ID, such as allowing a user to set up user namespace UID
> mappings. For now, only gating the set*uid family of syscalls is
> supported, with support for set*gid coming in a future patch set.
> 
> Signed-off-by: Micah Morton <mortonm at chromium.org>
> Acked-by: Kees Cook <keescook at chromium.org>

Both applied to
git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security.git next-general


-- 
James Morris
<jmorris at namei.org>