Paul Moore a3727a8bac selinux,smack: fix subjective/objective credential use mixups ... Jann Horn reported a problem with commit eb1231f73c ("selinux: clarify task subjective and objective credentials") where some LSM hooks were attempting to access the subjective credentials of a task other than the current task. Generally speaking, it is not safe to access another task's subjective credentials and doing so can cause a number of problems. Further, while looking into the problem, I realized that Smack was suffering from a similar problem brought about by a similar commit 1fb057dcde ("smack: differentiate between subjective and objective task credentials"). This patch addresses this problem by restoring the use of the task's objective credentials in those cases where the task is other than the current executing task. Not only does this resolve the problem reported by Jann, it is arguably the correct thing to do in these cases. Cc: stable@vger.kernel.org Fixes: eb1231f73c ("selinux: clarify task subjective and objective credentials") Fixes: 1fb057dcde ("smack: differentiate between subjective and objective task credentials") Reported-by: Jann Horn <jannh@google.com> Acked-by: Eric W. Biederman <ebiederm@xmission.com> Acked-by: Casey Schaufler <casey@schaufler-ca.com> Signed-off-by: Paul Moore <paul@paul-moore.com>		2021-09-23 12:30:59 -04:00
..
apparmor	apparmor: use get_unaligned() only for multi-byte words	2021-05-17 13:30:29 +02:00
bpf	bpf: Implement task local storage	2020-11-06 08:08:37 -08:00
integrity	integrity-v5.15	2021-09-02 12:51:41 -07:00
keys	trusted-keys: match tpm_get_ops on all return paths	2021-05-12 22:36:37 +03:00
landlock	landlock: Enable user space to infer supported features	2021-04-22 12:22:11 -07:00
loadpin	LSM: Add "contents" flag to kernel_read_file hook	2020-10-05 13:37:03 +02:00
lockdown	…
safesetid	LSM: SafeSetID: Mark safesetid_initialized as __initdata	2021-06-10 09:52:32 -07:00
selinux	selinux,smack: fix subjective/objective credential use mixups	2021-09-23 12:30:59 -04:00
smack	selinux,smack: fix subjective/objective credential use mixups	2021-09-23 12:30:59 -04:00
tomoyo	mm/pagemap: add mmap_assert_locked() annotations to find_vma*()	2021-09-03 09:58:13 -07:00
yama	task_work: cleanup notification modes	2020-10-17 15:05:30 -06:00
Kconfig	landlock: Set up the security framework and manage credentials	2021-04-22 12:22:10 -07:00
Kconfig.hardening	hardening: Clarify Kconfig text for auto-var-init	2021-07-20 23:02:59 -07:00
Makefile	security: remove unneeded subdir-$(CONFIG_...)	2021-09-03 08:17:20 +09:00
commoncap.c	Miscellaneous minor fixes for v5.13.	2021-04-27 19:32:55 -07:00
device_cgroup.c	device_cgroup: Fix RCU list debugging warning	2020-08-20 11:25:03 -07:00
inode.c	…
lsm_audit.c	audit: remove unnecessary 'ret' initialization	2021-06-11 13:21:28 -04:00
min_addr.c	…
security.c	bpf: Add lockdown check for probe_write_user helper	2021-08-10 10:10:10 +02:00