Commit 8ec2328f authored Nov 28, 2007 by Serge E. Hallyn Committed by Linus Torvalds Nov 29, 2007

file capabilities: don't prevent signaling setuid root programs



An unprivileged process must be able to kill a setuid root program started
by the same user.  This is legacy behavior needed for instance for xinit to
kill X when the window manager exits.

When an unprivileged user runs a setuid root program in !SECURE_NOROOT
mode, fP, fI, and fE are set full on, so pP' and pE' are full on.  Then
cap_task_kill() prevents the user from signaling the setuid root task.
This is a change in behavior compared to when
!CONFIG_SECURITY_FILE_CAPABILITIES.

This patch introduces a special check into cap_task_kill() just to check
whether a non-root user is signaling a setuid root program started by the
same user.  If so, then signal is allowed.

Signed-off-by: Serge E. Hallyn <serue@us.ibm.com>
Cc: Andrew Morgan <morgan@kernel.org>
Cc: Stephen Smalley <sds@epoch.ncsc.mil>
Cc: Chris Wright <chrisw@sous-sol.org>
Cc: James Morris <jmorris@namei.org>
Cc: Casey Schaufler <casey@schaufler-ca.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

parent d0eec99c

security/commoncap.c

+9 −0

Original line number	Diff line number	Diff line
		@@ -526,6 +526,15 @@ int cap_task_kill(struct task_struct p, struct siginfo info,
		if (info != SEND_SIG_NOINFO && (is_si_special(info) \|\| SI_FROMKERNEL(info)))
		return 0;

		/*
		* Running a setuid root program raises your capabilities.
		* Killing your own setuid root processes was previously
		* allowed.
		* We must preserve legacy signal behavior in this case.
		*/
		if (p->euid == 0 && p->uid == current->uid)
		return 0;

		/* sigcont is permitted within same session */
		if (sig == SIGCONT && (task_session_nr(current) == task_session_nr(p)))
		return 0;

Admin message