Re: [PATCH ghak90 V9 11/13] audit: contid check descendancy and nesting

Require the target task to be a descendant of the container
orchestrator/engine.

You would only change the audit container ID from one set or inherited
value to another if you were nesting containers.

If changing the contid, the container orchestrator/engine must be a
descendant and not same orchestrator as the one that set it so it is not
possible to change the contid of another orchestrator's container.

Since the task_is_descendant() function is used in YAMA and in audit,
remove the duplication and pull the function into kernel/core/sched.c

Signed-off-by: Richard Guy Briggs <redacted>
---
 include/linux/sched.h    |  3 +++
 kernel/audit.c           | 23 +++++++++++++++++++++--
 kernel/sched/core.c      | 33 +++++++++++++++++++++++++++++++++
 security/yama/yama_lsm.c | 33 ---------------------------------
 4 files changed, 57 insertions(+), 35 deletions(-)

diff --git a/include/linux/sched.h b/include/linux/sched.h
index 2213ac670386..06938d0b9e0c 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h

@@ -2047,4 +2047,7 @@ static inline void rseq_syscall(struct pt_regs *regs)

 const struct cpumask *sched_trace_rd_span(struct root_domain *rd);

+extern int task_is_descendant(struct task_struct *parent,
+                             struct task_struct *child);
+
 #endif

diff --git a/kernel/audit.c b/kernel/audit.c
index a862721dfd9b..efa65ec01239 100644
--- a/kernel/audit.c
+++ b/kernel/audit.c

@@ -2713,6 +2713,20 @@ int audit_signal_info(int sig, struct task_struct *t)
        return audit_signal_info_syscall(t);
 }

+static bool audit_contid_isnesting(struct task_struct *tsk)
+{
+       bool isowner = false;
+       bool ownerisparent = false;
+
+       rcu_read_lock();
+       if (tsk->audit && tsk->audit->cont) {
+               isowner = current == tsk->audit->cont->owner;
+               ownerisparent = task_is_descendant(tsk->audit->cont->owner, current);

+       }
+       rcu_read_unlock();
+       return !isowner && ownerisparent;
+}
+
 /*
  * audit_set_contid - set current task's audit contid
  * @task: target task

@@ -2755,8 +2769,13 @@ int audit_set_contid(struct task_struct *task, u64 contid)
                rc = -EBUSY;
                goto unlock;
        }
-       /* if contid is already set, deny */
-       if (audit_contid_set(task))
+       /* if task is not descendant, block */
+       if (task == current || !task_is_descendant(current, task)) {