Commit 3863935f authored Oct 30, 2020 by Mickaël Salaün Committed by Greg Kroah-Hartman Nov 24, 2020

seccomp: Set PF_SUPERPRIV when checking capability



commit fb14528e443646dd3fd02df4437fcf5265b66baa upstream.

Replace the use of security_capable(current_cred(), ...) with
ns_capable_noaudit() which set PF_SUPERPRIV.

Since commit 98f368e9 ("kernel: Add noaudit variant of
ns_capable()"), a new ns_capable_noaudit() helper is available.  Let's
use it!

Cc: Jann Horn <jannh@google.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Tyler Hicks <tyhicks@linux.microsoft.com>
Cc: Will Drewry <wad@chromium.org>
Cc: stable@vger.kernel.org
Fixes: e2cfabdf ("seccomp: add system call filtering using BPF")
Signed-off-by: Mickaël Salaün <mic@linux.microsoft.com>
Reviewed-by: Jann Horn <jannh@google.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/r/20201030123849.770769-3-mic@digikod.net


Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

parent 26c5606f

kernel/seccomp.c

+2 −3

Original line number	Diff line number	Diff line
		@@ -36,7 +36,7 @@
		#include <linux/filter.h>
		#include <linux/pid.h>
		#include <linux/ptrace.h>
		#include <linux/security.h>
		#include <linux/capability.h>
		#include <linux/tracehook.h>
		#include <linux/uaccess.h>

		@@ -383,8 +383,7 @@ static struct seccomp_filter seccomp_prepare_filter(struct sock_fprog fprog)
		* behavior of privileged children.
		*/
		if (!task_no_new_privs(current) &&
		security_capable(current_cred(), current_user_ns(),
		CAP_SYS_ADMIN, CAP_OPT_NOAUDIT) != 0)
		!ns_capable_noaudit(current_user_ns(), CAP_SYS_ADMIN))
		return ERR_PTR(-EACCES);

		/* Allocate a new seccomp_filter */