summaryrefslogtreecommitdiff
path: root/Documentation/admin-guide/LSM
diff options
context:
space:
mode:
authorMicah Morton <mortonm@chromium.org>2019-01-23 01:42:09 +0300
committerJames Morris <james.morris@microsoft.com>2019-01-25 22:22:43 +0300
commit40852275a94afb3e836be9248399e036982d1a79 (patch)
tree97db7b5d7dfae0ecd678b57bc861e60e949afe44 /Documentation/admin-guide/LSM
parent4b42564181d683d767b495d7041b1f229468042f (diff)
downloadlinux-40852275a94afb3e836be9248399e036982d1a79.tar.xz
LSM: add SafeSetID module that gates setid calls
This change ensures that the set*uid family of syscalls in kernel/sys.c (setreuid, setuid, setresuid, setfsuid) all call ns_capable_common with the CAP_OPT_INSETID flag, so capability checks in the security_capable hook can know whether they are being called from within a set*uid syscall. This change is a no-op by itself, but is needed for the proposed SafeSetID LSM. Signed-off-by: Micah Morton <mortonm@chromium.org> Acked-by: Kees Cook <keescook@chromium.org> Signed-off-by: James Morris <james.morris@microsoft.com>
Diffstat (limited to 'Documentation/admin-guide/LSM')
0 files changed, 0 insertions, 0 deletions