RE: [RFC PATCH 0/1] security: add SECURE_KEEP_FSUID to preserve fsuid/fsgid across execve

2019-07-02 Thread Lubashev, Igor
> From: James Morris on Friday, June 14, 2019 11:54 PM: > On Sat, 15 Jun 2019, Lubashev, Igor wrote: > > > Unfortunately, perf is using uid==0 and euid==0 as a "capability bits". > > > > > > In tools/perf/util/evsel.c: > > static bool perf_event_can_profile_kernel(void) > > { > >

RE: [RFC PATCH 0/1] security: add SECURE_KEEP_FSUID to preserve fsuid/fsgid across execve

2019-06-14 Thread James Morris
On Sat, 15 Jun 2019, Lubashev, Igor wrote: > > On Friday, June 14, 2019, James Morris wrote: > Unfortunately, perf is using uid==0 and euid==0 as a "capability bits". > > > In tools/perf/util/evsel.c: > static bool perf_event_can_profile_kernel(void) > { > return

RE: [RFC PATCH 0/1] security: add SECURE_KEEP_FSUID to preserve fsuid/fsgid across execve

2019-06-14 Thread Lubashev, Igor
> On Friday, June 14, 2019, James Morris wrote: > On Thu, 13 Jun 2019, Igor Lubashev wrote: > > > I've posted this in March but received no response. Reposting. > > > > This patch introduces SECURE_KEEP_FSUID to allow fsuid/fsgid to be > > preserved across execve. It is currently impossible to

Re: [RFC PATCH 0/1] security: add SECURE_KEEP_FSUID to preserve fsuid/fsgid across execve

2019-06-13 Thread James Morris
On Thu, 13 Jun 2019, Igor Lubashev wrote: > I've posted this in March but received no response. Reposting. > > This patch introduces SECURE_KEEP_FSUID to allow fsuid/fsgid to be > preserved across execve. It is currently impossible to execve a > program such that effective and filesystem uid

Re: [RFC PATCH 0/1] security: add SECURE_KEEP_FSUID to preserve fsuid/fsgid across execve

2019-06-13 Thread James Morris
[Adding David and Al] On Thu, 13 Jun 2019, Igor Lubashev wrote: > I've posted this in March but received no response. Reposting. > > This patch introduces SECURE_KEEP_FSUID to allow fsuid/fsgid to be > preserved across execve. It is currently impossible to execve a > program such that