From: "Theodore Ts'o" <tytso@mit.edu>
To: "Christian Göttsche" <cgoettsche@seltendoof.de>
Cc: "Theodore Ts'o" <tytso@mit.edu>,
"Christian Göttsche" <cgzones@googlemail.com>,
"Serge Hallyn" <serge@hallyn.com>, "Jan Kara" <jack@suse.com>,
"Julia Lawall" <Julia.Lawall@inria.fr>,
"Nicolas Palix" <nicolas.palix@imag.fr>,
linux-kernel@vger.kernel.org,
linux-security-module@vger.kernel.org, cocci@inria.fr
Subject: Re: [cocci] [PATCH v2 01/11] coccinelle: Add script to reorder capable() calls
Date: Mon, 17 Mar 2025 23:41:14 -0400 [thread overview]
Message-ID: <174226639139.1025346.1787648992312533082.b4-ty@mit.edu> (raw)
In-Reply-To: <20250302160657.127253-11-cgoettsche@seltendoof.de>
On Sun, 02 Mar 2025 17:06:48 +0100, Christian Göttsche wrote:
> capable() calls refer to enabled LSMs whether to permit or deny the
> request. This is relevant in connection with SELinux, where a
> capability check results in a policy decision and by default a denial
> message on insufficient permission is issued.
> It can lead to three undesired cases:
> 1. A denial message is generated, even in case the operation was an
> unprivileged one and thus the syscall succeeded, creating noise.
> 2. To avoid the noise from 1. the policy writer adds a rule to ignore
> those denial messages, hiding future syscalls, where the task
> performs an actual privileged operation, leading to hidden limited
> functionality of that task.
> 3. To avoid the noise from 1. the policy writer adds a rule to permit
> the task the requested capability, while it does not need it,
> violating the principle of least privilege.
>
> [...]
Applied, thanks!
[03/11] ext4: reorder capability check last
commit: 26f5784d44c3f824c864245b506db809b51053cf
Best regards,
--
Theodore Ts'o <tytso@mit.edu>
prev parent reply other threads:[~2025-03-18 9:12 UTC|newest]
Thread overview: 19+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-03-02 16:06 [cocci] [PATCH v2 02/11] quota: reorder capability check last Christian Göttsche
2025-03-02 16:06 ` [cocci] [PATCH v2 03/11] ext4: " Christian Göttsche
2025-03-04 10:51 ` Jan Kara
2025-03-02 16:06 ` [cocci] [PATCH v2 04/11] hugetlbfs: " Christian Göttsche
2025-03-02 16:06 ` [cocci] [PATCH v2 05/11] genwqe: " Christian Göttsche
2025-03-02 16:06 ` [cocci] [PATCH v2 06/11] ubifs: " Christian Göttsche
2025-03-03 13:49 ` Zhihao Cheng
2025-03-02 16:06 ` [cocci] [PATCH v2 07/11] drm/panthor: " Christian Göttsche
2025-03-02 16:06 ` [cocci] [PATCH v2 08/11] ipv4: " Christian Göttsche
2025-03-02 18:24 ` Eric Dumazet
2025-03-02 16:06 ` [cocci] [PATCH v2 09/11] fs: " Christian Göttsche
2025-03-02 16:06 ` [cocci] [PATCH v2 10/11] skbuff: " Christian Göttsche
2025-03-04 14:06 ` Willem de Bruijn
2025-03-02 16:06 ` [cocci] [PATCH v2 11/11] infiniband: " Christian Göttsche
2025-03-03 19:04 ` Leon Romanovsky
2025-03-02 16:06 ` [cocci] [PATCH v2 01/11] coccinelle: Add script to reorder capable() calls Christian Göttsche
2025-03-02 16:53 ` Casey Schaufler
2025-03-02 18:35 ` Christian Göttsche
2025-03-18 3:41 ` Theodore Ts'o [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=174226639139.1025346.1787648992312533082.b4-ty@mit.edu \
--to=tytso@mit.edu \
--cc=Julia.Lawall@inria.fr \
--cc=cgoettsche@seltendoof.de \
--cc=cgzones@googlemail.com \
--cc=cocci@inria.fr \
--cc=jack@suse.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=nicolas.palix@imag.fr \
--cc=serge@hallyn.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).