Re: [PATCH ghak90 V9 11/13] audit: contid check descendancy and nesting

Require the target task to be a descendant of the container orchestrator/engine. You would only change the audit container ID from one set or inherited value to another if you were nesting containers. If changing the contid, the container orchestrator/engine must be a descendant and not same orchestrator as the one that set it so it is not possible to change the contid of another orchestrator's container. Since the task_is_descendant() function is used in YAMA and in audit, remove the duplication and pull the function into kernel/core/sched.c Signed-off-by: Richard Guy Briggs <rgb(a)redhat.com&gt; --- include/linux/sched.h | 3 +++ kernel/audit.c | 23 +++++++++++++++++++++-- kernel/sched/core.c | 33 +++++++++++++++++++++++++++++++++ security/yama/yama_lsm.c | 33 --------------------------------- 4 files changed, 57 insertions(+), 35 deletions(-) diff --git a/include/linux/sched.h b/include/linux/sched.h index 2213ac670386..06938d0b9e0c 100644 --- a/include/linux/sched.h +++ b/include/linux/sched.h @@ -2047,4 +2047,7 @@ static inline void rseq_syscall(struct pt_regs *regs) const struct cpumask *sched_trace_rd_span(struct root_domain *rd); +extern int task_is_descendant(struct task_struct *parent, + struct task_struct *child); + #endif diff --git a/kernel/audit.c b/kernel/audit.c index a862721dfd9b..efa65ec01239 100644 --- a/kernel/audit.c +++ b/kernel/audit.c @@ -2713,6 +2713,20 @@ int audit_signal_info(int sig, struct task_struct *t) return audit_signal_info_syscall(t); } +static bool audit_contid_isnesting(struct task_struct *tsk) +{ + bool isowner = false; + bool ownerisparent = false; + + rcu_read_lock(); + if (tsk->audit && tsk->audit->cont) { + isowner = current == tsk->audit->cont->owner; + ownerisparent = task_is_descendant(tsk->audit->cont->owner, current);

+ } + rcu_read_unlock(); + return !isowner && ownerisparent; +} + /* * audit_set_contid - set current task's audit contid * @task: target task @@ -2755,8 +2769,13 @@ int audit_set_contid(struct task_struct *task, u64 contid) rc = -EBUSY; goto unlock; } - /* if contid is already set, deny */ - if (audit_contid_set(task)) + /* if task is not descendant, block */ + if (task == current || !task_is_descendant(current, task)) {

+ rc = -EXDEV;

+ goto unlock; + } + /* only allow contid setting again if nesting */ + if (audit_contid_set(task) && !audit_contid_isnesting(task)) rc = -EEXIST;