[GIT PULL] SafeSetID changes for v5.10

From: Micah Morton
Date: Thu Oct 15 2020 - 14:15:35 EST


The following changes since commit bbf5c979011a099af5dc76498918ed7df445635b:

Linux 5.9 (2020-10-11 14:15:50 -0700)

are available in the Git repository at:

https://github.com/micah-morton/linux.git tags/safesetid-5.10

for you to fetch changes up to 03ca0ec138927b16fab0dad7b869f42eb2849c94:

LSM: SafeSetID: Fix warnings reported by test bot (2020-10-13 09:17:36 -0700)

----------------------------------------------------------------
SafeSetID changes for v5.10

The changes in this pull request are mostly contained to within the
SafeSetID LSM, with the exception of a few 1-line changes to change
some ns_capable() calls to ns_capable_setid() -- causing a flag
(CAP_OPT_INSETID) to be set that is examined by SafeSetID code and
nothing else in the kernel. These changes have been baking in -next and
actually were in -next for the entire v5.9 merge window but I didn't
have a chance to send them.

The changes to SafeSetID internally allow for setting up GID transition
security policies, as already existed for UIDs.

NOTE: I'm re-using my safesetid-next branch here as the branch for
creating the pull request. I think that's fine, not sure if this is the
normal workflow or not. Also, I use 'git rebase vX.X' to put my commits
on top of the latest stable release. Again, I verified with gitk that I
don't have any weird history in my branch that will mess things up so
AFAICT that should be fine too.

----------------------------------------------------------------

Thomas Cedeno (3):
LSM: Signal to SafeSetID when setting group IDs
LSM: SafeSetID: Add GID security policy handling
LSM: SafeSetID: Fix warnings reported by test bot

Documentation/admin-guide/LSM/SafeSetID.rst | 29 +++--
kernel/capability.c | 2 +-
kernel/groups.c | 2 +-
kernel/sys.c | 10 +-
security/safesetid/lsm.c | 190 +++++++++++++++++++++-------
security/safesetid/lsm.h | 38 ++++--
security/safesetid/securityfs.c | 190 ++++++++++++++++++++--------
7 files changed, 336 insertions(+), 125 deletions(-)