summaryrefslogtreecommitdiffstats
path: root/kernel
diff options
context:
space:
mode:
authorEric Paris <eparis@redhat.com>2012-01-03 14:23:08 -0500
committerAl Viro <viro@zeniv.linux.org.uk>2012-01-17 16:17:00 -0500
commit633b45454503489209b0d9a45f9e3cd1b852c614 (patch)
tree591363d3be6b773f872b979727d4ac1a9691ec82 /kernel
parent0a300be6d5be8f66cd96609334710c268d0bfdce (diff)
downloadlinux-633b45454503489209b0d9a45f9e3cd1b852c614.tar.gz
linux-633b45454503489209b0d9a45f9e3cd1b852c614.tar.bz2
linux-633b45454503489209b0d9a45f9e3cd1b852c614.zip
audit: only allow tasks to set their loginuid if it is -1
At the moment we allow tasks to set their loginuid if they have CAP_AUDIT_CONTROL. In reality we want tasks to set the loginuid when they log in and it be impossible to ever reset. We had to make it mutable even after it was once set (with the CAP) because on update and admin might have to restart sshd. Now sshd would get his loginuid and the next user which logged in using ssh would not be able to set his loginuid. Systemd has changed how userspace works and allowed us to make the kernel work the way it should. With systemd users (even admins) are not supposed to restart services directly. The system will restart the service for them. Thus since systemd is going to loginuid==-1, sshd would get -1, and sshd would be allowed to set a new loginuid without special permissions. If an admin in this system were to manually start an sshd he is inserting himself into the system chain of trust and thus, logically, it's his loginuid that should be used! Since we have old systems I make this a Kconfig option. Signed-off-by: Eric Paris <eparis@redhat.com>
Diffstat (limited to 'kernel')
-rw-r--r--kernel/auditsc.c11
1 files changed, 10 insertions, 1 deletions
diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index 9d6dd7d869c0..bd084a13c719 100644
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -2173,9 +2173,18 @@ static atomic_t session_id = ATOMIC_INIT(0);
int audit_set_loginuid(uid_t loginuid)
{
struct task_struct *task = current;
- unsigned int sessionid = atomic_inc_return(&session_id);
struct audit_context *context = task->audit_context;
+ unsigned int sessionid;
+
+#ifdef CONFIG_AUDIT_LOGINUID_IMMUTABLE
+ if (task->loginuid != -1)
+ return -EPERM;
+#else /* CONFIG_AUDIT_LOGINUID_IMMUTABLE */
+ if (!capable(CAP_AUDIT_CONTROL))
+ return -EPERM;
+#endif /* CONFIG_AUDIT_LOGINUID_IMMUTABLE */
+ sessionid = atomic_inc_return(&session_id);
if (context && context->in_syscall) {
struct audit_buffer *ab;