kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-11-10 20:48:12 +00:00
Code Issues Releases Packages Activity
linux/ipc
History
Ondrej Mosnacek 8fd58e0a0f ipc: don't audit capability check in ipc_permissions() 
[ Upstream commit 0715881360 ]

The IPC sysctls implement the ctl_table_root::permissions hook and
they override the file access mode based on the CAP_CHECKPOINT_RESTORE
capability, which is being checked regardless of whether any access is
actually denied or not, so if an LSM denies the capability, an audit
record may be logged even when access is in fact granted.

It wouldn't be viable to restructure the sysctl permission logic to only
check the capability when the access would be actually denied if it's
not granted. Thus, do the same as in net_ctl_permissions()
(net/sysctl_net.c) - switch from ns_capable() to ns_capable_noaudit(),
so that the check never emits an audit record.

Fixes: 0889f44e28 ("ipc: Check permissions for checkpoint_restart sysctls at open time")
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Acked-by: Alexey Gladkov <legion@kernel.org>
Acked-by: Serge Hallyn <serge@hallyn.com>
Signed-off-by: Serge Hallyn <sergeh@kernel.org>
Stable-dep-of: 8924336531 ("ipc: don't audit capability check in ipc_permissions()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
History 2026-02-26 14:59:19 -08:00
..
compat.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
ipc_sysctl.c ipc: don't audit capability check in ipc_permissions() 2026-02-26 14:59:19 -08:00
Makefile License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
mq_sysctl.c treewide: const qualify ctl_tables where applicable 2025-01-28 13:48:37 +01:00
mqueue.c mount changes. I've got more stuff in the local tree, but 2025-07-28 10:49:38 -07:00
msg.c ipc/msg: replace one-element array with flexible array member 2024-11-05 17:12:28 -08:00
msgutil.c ns: move ns type into struct ns_common 2025-09-25 09:23:54 +02:00
namespace.c namespace-6.18-rc1 2025-09-29 11:20:29 -07:00
sem.c copy_process: pass clone_flags as u64 across calltree 2025-09-01 15:31:34 +02:00
shm.c ipc: support ns lookup 2025-09-19 14:26:15 +02:00
syscall.c y2038: remove CONFIG_64BIT_TIME 2019-11-15 14:38:27 +01:00
util.c ipc/util.c: complete the kernel-doc function descriptions 2025-01-24 22:47:27 -08:00
util.h sched.h: move pid helpers to pid.h 2023-12-20 19:26:31 -05:00