Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9227dd2a authored by Eric W. Biederman's avatar Eric W. Biederman
Browse files

exec: Remove LSM_UNSAFE_PTRACE_CAP 



With previous changes every location that tests for
LSM_UNSAFE_PTRACE_CAP also tests for LSM_UNSAFE_PTRACE making the
LSM_UNSAFE_PTRACE_CAP redundant, so remove it.

Signed-off-by: default avatar"Eric W. Biederman" <ebiederm@xmission.com>
parent 20523132

fs/exec.c

+2 −6
Original line number Diff line number Diff line
@@ -1426,12 +1426,8 @@ static void check_unsafe_exec(struct linux_binprm *bprm) 
	struct task_struct *p = current, *t;

	unsigned n_fs;



	if (p->ptrace) {

		if (ptracer_capable(p, current_user_ns()))

			bprm->unsafe |= LSM_UNSAFE_PTRACE_CAP;

		else

	if (p->ptrace)

		bprm->unsafe |= LSM_UNSAFE_PTRACE;

	}



	/*

	 * This isn't strictly necessary, but it makes it harder for LSMs to

include/linux/security.h

+1 −2
Original line number Diff line number Diff line
@@ -140,8 +140,7 @@ struct request_sock; 
/* bprm->unsafe reasons */

#define LSM_UNSAFE_SHARE	1

#define LSM_UNSAFE_PTRACE	2

#define LSM_UNSAFE_PTRACE_CAP	4

#define LSM_UNSAFE_NO_NEW_PRIVS	8

#define LSM_UNSAFE_NO_NEW_PRIVS	4



#ifdef CONFIG_MMU

extern int mmap_min_addr_handler(struct ctl_table *table, int write,

security/apparmor/domain.c

+1 −1
Original line number Diff line number Diff line
@@ -469,7 +469,7 @@ int apparmor_bprm_set_creds(struct linux_binprm *bprm) 
		;

	}



	if (bprm->unsafe & (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {

	if (bprm->unsafe & LSM_UNSAFE_PTRACE) {

		error = may_change_ptraced_domain(new_profile);

		if (error)

			goto audit;

security/commoncap.c

+1 −1
Original line number Diff line number Diff line
@@ -548,7 +548,7 @@ int cap_bprm_set_creds(struct linux_binprm *bprm) 


	if ((is_setid ||

	     !cap_issubset(new->cap_permitted, old->cap_permitted)) &&

	    ((bprm->unsafe & ~(LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) ||

	    ((bprm->unsafe & ~LSM_UNSAFE_PTRACE) ||

	     !ptracer_capable(current, new->user_ns))) {

		/* downgrade; they get no more than they had, and maybe less */

		if (!ns_capable(new->user_ns, CAP_SETUID) ||

security/selinux/hooks.c

+1 −2
Original line number Diff line number Diff line
@@ -2404,8 +2404,7 @@ static int selinux_bprm_set_creds(struct linux_binprm *bprm) 


		/* Make sure that anyone attempting to ptrace over a task that

		 * changes its SID has the appropriate permit */

		if (bprm->unsafe &

		    (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {

		if (bprm->unsafe & LSM_UNSAFE_PTRACE) {

			u32 ptsid = ptrace_parent_sid(current);

			if (ptsid != 0) {

				rc = avc_has_perm(ptsid, new_tsec->sid,