[PATCH v5 2/2] LSM: add SafeSetID module that gates setid calls

[Micah Morton]

Thanks!

On Fri, Jan 25, 2019 at 12:15 PM James Morris <jmorris at namei.org> wrote:
>
> On Wed, 16 Jan 2019, mortonm at chromium.org wrote:
>
> > From: Micah Morton <mortonm at chromium.org>
> >
> > SafeSetID gates the setid family of syscalls to restrict UID/GID
> > transitions from a given UID/GID to only those approved by a
> > system-wide whitelist. These restrictions also prohibit the given
> > UIDs/GIDs from obtaining auxiliary privileges associated with
> > CAP_SET{U/G}ID, such as allowing a user to set up user namespace UID
> > mappings. For now, only gating the set*uid family of syscalls is
> > supported, with support for set*gid coming in a future patch set.
> >
> > Signed-off-by: Micah Morton <mortonm at chromium.org>
> > Acked-by: Kees Cook <keescook at chromium.org>
>
> Both applied to
> git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security.git next-general
>
>
> --
> James Morris
> <jmorris at namei.org>
>