aboutsummaryrefslogtreecommitdiffstats
path: root/security/commoncap.c
diff options
context:
space:
mode:
authorSerge Hallyn <serge@hallyn.com>2008-02-29 10:14:57 -0500
committerLinus Torvalds <torvalds@linux-foundation.org>2008-03-20 12:46:36 -0400
commitaedb60a67c10a0861af179725d060765262ba0fb (patch)
tree4a4a316f9f7d1ab0bf4da2cdd5c802bfb05c947f /security/commoncap.c
parent457fb605834504af294916411be128a9b21fc3f6 (diff)
file capabilities: remove cap_task_kill()
The original justification for cap_task_kill() was as follows: check_kill_permission() does appropriate uid equivalence checks. However with file capabilities it becomes possible for an unprivileged user to execute a file with file capabilities resulting in a more privileged task with the same uid. However now that cap_task_kill() always returns 0 (permission granted) when p->uid==current->uid, the whole hook is worthless, and only likely to create more subtle problems in the corner cases where it might still be called but return -EPERM. Those cases are basically when uids are different but euid/suid is equivalent as per the check in check_kill_permission(). One example of a still-broken application is 'at' for non-root users. This patch removes cap_task_kill(). Signed-off-by: Serge Hallyn <serge@hallyn.com> Acked-by: Andrew G. Morgan <morgan@kernel.org> Earlier-version-tested-by: Luiz Fernando N. Capitulino <lcapitulino@mandriva.com.br> Acked-by: Casey Schaufler <casey@schaufler-ca.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'security/commoncap.c')
-rw-r--r--security/commoncap.c40
1 files changed, 0 insertions, 40 deletions
diff --git a/security/commoncap.c b/security/commoncap.c
index bb0c095f5761..06d5c9469ba3 100644
--- a/security/commoncap.c
+++ b/security/commoncap.c
@@ -540,41 +540,6 @@ int cap_task_setnice (struct task_struct *p, int nice)
540 return cap_safe_nice(p); 540 return cap_safe_nice(p);
541} 541}
542 542
543int cap_task_kill(struct task_struct *p, struct siginfo *info,
544 int sig, u32 secid)
545{
546 if (info != SEND_SIG_NOINFO && (is_si_special(info) || SI_FROMKERNEL(info)))
547 return 0;
548
549 /*
550 * Running a setuid root program raises your capabilities.
551 * Killing your own setuid root processes was previously
552 * allowed.
553 * We must preserve legacy signal behavior in this case.
554 */
555 if (p->uid == current->uid)
556 return 0;
557
558 /* sigcont is permitted within same session */
559 if (sig == SIGCONT && (task_session_nr(current) == task_session_nr(p)))
560 return 0;
561
562 if (secid)
563 /*
564 * Signal sent as a particular user.
565 * Capabilities are ignored. May be wrong, but it's the
566 * only thing we can do at the moment.
567 * Used only by usb drivers?
568 */
569 return 0;
570 if (cap_issubset(p->cap_permitted, current->cap_permitted))
571 return 0;
572 if (capable(CAP_KILL))
573 return 0;
574
575 return -EPERM;
576}
577
578/* 543/*
579 * called from kernel/sys.c for prctl(PR_CABSET_DROP) 544 * called from kernel/sys.c for prctl(PR_CABSET_DROP)
580 * done without task_capability_lock() because it introduces 545 * done without task_capability_lock() because it introduces
@@ -605,11 +570,6 @@ int cap_task_setnice (struct task_struct *p, int nice)
605{ 570{
606 return 0; 571 return 0;
607} 572}
608int cap_task_kill(struct task_struct *p, struct siginfo *info,
609 int sig, u32 secid)
610{
611 return 0;
612}
613#endif 573#endif
614 574
615void cap_task_reparent_to_init (struct task_struct *p) 575void cap_task_reparent_to_init (struct task_struct *p)