Re: [PATCH v5 2/2] LSM: add SafeSetID module that gates setid calls

Thanks!

On Fri, Jan 25, 2019 at 12:15 PM James Morris [off-list ref] wrote:

On Wed, 16 Jan 2019, mortonm@chromium.org wrote:

quoted

From: Micah Morton <mortonm@chromium.org>

SafeSetID gates the setid family of syscalls to restrict UID/GID
transitions from a given UID/GID to only those approved by a
system-wide whitelist. These restrictions also prohibit the given
UIDs/GIDs from obtaining auxiliary privileges associated with
CAP_SET{U/G}ID, such as allowing a user to set up user namespace UID
mappings. For now, only gating the set*uid family of syscalls is
supported, with support for set*gid coming in a future patch set.

Signed-off-by: Micah Morton <mortonm@chromium.org>
Acked-by: Kees Cook <redacted>

Both applied to
git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security.git next-general


--
James Morris
[off-list ref]