security: Add LSM hook to setgroups() syscall

Browse source

Give the LSM framework the ability to filter setgroups() syscalls. There
are already analagous hooks for the set*uid() and set*gid() syscalls.
The SafeSetID LSM will use this new hook to ensure setgroups() calls are
allowed by the installed security policy. Tested by putting print
statement in security_task_fix_setgroups() hook and confirming that it
gets hit when userspace does a setgroups() syscall.

Acked-by: Casey Schaufler <casey@schaufler-ca.com>
Reviewed-by: Serge Hallyn <serge@hallyn.com>
Signed-off-by: Micah Morton <mortonm@chromium.org>

...

This commit is contained in:

Micah Morton 2022-06-08 20:57:11 +00:00

parent a1732d6898

commit fcfe0ac2fc

5 changed files with 33 additions and 0 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

1

include/linux/lsm_hook_defs.h

View file

7

include/linux/lsm_hooks.h

View file

7

include/linux/security.h

View file