[PATCH v5 2/2] LSM: add SafeSetID module that gates setid calls

James Morris jmorris at namei.org
Fri Jan 25 20:15:22 UTC 2019


On Wed, 16 Jan 2019, mortonm at chromium.org wrote:

> From: Micah Morton <mortonm at chromium.org>
> 
> SafeSetID gates the setid family of syscalls to restrict UID/GID
> transitions from a given UID/GID to only those approved by a
> system-wide whitelist. These restrictions also prohibit the given
> UIDs/GIDs from obtaining auxiliary privileges associated with
> CAP_SET{U/G}ID, such as allowing a user to set up user namespace UID
> mappings. For now, only gating the set*uid family of syscalls is
> supported, with support for set*gid coming in a future patch set.
> 
> Signed-off-by: Micah Morton <mortonm at chromium.org>
> Acked-by: Kees Cook <keescook at chromium.org>

Both applied to
git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security.git next-general


-- 
James Morris
<jmorris at namei.org>



More information about the Linux-security-module-archive mailing list