mirror of
https://github.com/team-infusion-developers/android_kernel_samsung_msm8976.git
synced 2024-09-21 03:43:03 +00:00
groups: Consolidate the setgroups permission checks
commit 7ff4d90b4c24a03666f296c3d4878cd39001e81e upstream. Today there are 3 instances of setgroups and due to an oversight their permission checking has diverged. Add a common function so that they may all share the same permission checking code. This corrects the current oversight in the current permission checks and adds a helper to avoid this in the future. A user namespace security fix will update this new helper, shortly. Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
c65d3b05d2
commit
4accc8c8e2
|
@ -248,7 +248,7 @@ asmlinkage long sys32_setgroups16(int gidsetsize, u16 __user *grouplist)
|
|||
struct group_info *group_info;
|
||||
int retval;
|
||||
|
||||
if (!capable(CAP_SETGID))
|
||||
if (!may_setgroups())
|
||||
return -EPERM;
|
||||
if ((unsigned)gidsetsize > NGROUPS_MAX)
|
||||
return -EINVAL;
|
||||
|
|
|
@ -68,6 +68,7 @@ extern void groups_free(struct group_info *);
|
|||
extern int set_current_groups(struct group_info *);
|
||||
extern int set_groups(struct cred *, struct group_info *);
|
||||
extern int groups_search(const struct group_info *, kgid_t);
|
||||
extern bool may_setgroups(void);
|
||||
|
||||
/* access the groups "array" with this macro */
|
||||
#define GROUP_AT(gi, i) \
|
||||
|
|
|
@ -223,6 +223,13 @@ out:
|
|||
return i;
|
||||
}
|
||||
|
||||
bool may_setgroups(void)
|
||||
{
|
||||
struct user_namespace *user_ns = current_user_ns();
|
||||
|
||||
return ns_capable(user_ns, CAP_SETGID);
|
||||
}
|
||||
|
||||
/*
|
||||
* SMP: Our groups are copy-on-write. We can set them safely
|
||||
* without another task interfering.
|
||||
|
@ -233,7 +240,7 @@ SYSCALL_DEFINE2(setgroups, int, gidsetsize, gid_t __user *, grouplist)
|
|||
struct group_info *group_info;
|
||||
int retval;
|
||||
|
||||
if (!nsown_capable(CAP_SETGID))
|
||||
if (!may_setgroups())
|
||||
return -EPERM;
|
||||
if ((unsigned)gidsetsize > NGROUPS_MAX)
|
||||
return -EINVAL;
|
||||
|
|
|
@ -176,7 +176,7 @@ SYSCALL_DEFINE2(setgroups16, int, gidsetsize, old_gid_t __user *, grouplist)
|
|||
struct group_info *group_info;
|
||||
int retval;
|
||||
|
||||
if (!nsown_capable(CAP_SETGID))
|
||||
if (!may_setgroups())
|
||||
return -EPERM;
|
||||
if ((unsigned)gidsetsize > NGROUPS_MAX)
|
||||
return -EINVAL;
|
||||
|
|
Loading…
Reference in a new issue