Re: [PATCH 1/2] security: safesetid: use real GID for GID policy lookup

[Paul Moore]

On Sun, Oct 4, 2026 at 6:05 PM Serge E. Hallyn <serge@xxxxxxxxxx> wrote:
> On Sat, Oct 03, 2026 at 07:34:15PM +0900, tjdqudcks0424@xxxxxxxxx wrote:
> > From: Sung Byeongchan <tjdqudcks0424@xxxxxxxxx>
> >
> > SafeSetID policies constrain the ID transitions available to a task for
> > each source ID.  id_permitted_for_cred() always builds that source key
> > from the old real UID, even when it is checking a GID transition.  If the
> > real UID and real GID differ, the policy attached to the real GID is
> > therefore missed and the lookup can return the unconstrained default.
> >
> > On current mainline, a test task with real UID 1000, real GID 2000 and
> > only CAP_SETGID obtained non-allowlisted GID 2002 despite a 2000:2001 GID
> > policy.  The bypass reproduced for setgid(), setegid(), setregid(),
> > setresgid(), setfsgid() and setgroups() across three clean QEMU boots,
> > and enabled access to a synthetic group-protected resource.  This shows
> > a SafeSetID GID policy bypass and group privilege expansion; it does not
> > show direct UID 0 elevation or a universal local privilege escalation.
> >
> > Build the source key from the old real UID for UID policy checks and the
> > old real GID for GID policy checks.  In three fixed-kernel boots, all
> > tested non-allowlisted transitions were blocked while the allowed target,
> > existing-ID, no-policy and UID-policy controls, and the existing SafeSetID
> > selftest continued to pass.
> >
> > Fixes: 5294bac97e12 ("LSM: SafeSetID: Add GID security policy handling")
> > Cc: stable@xxxxxxxxxxxxxxx
> > Assisted-by: OpenAI Codex
> > Signed-off-by: Sung Byeongchan <tjdqudcks0424@xxxxxxxxx>
>
> Seems obviously correct.  Thanks for the find and the fix.
>
> Reviewed-by: Serge Hallyn <serge@xxxxxxxxxx>

Looks good to me too, thanks!

Reviewed-by: Paul Moore <paul@xxxxxxxxxxxxxx>

Micah, assuming this looks good to you, are you planning to pick this
up?  If you would like me to take this via the LSM tree, please let me
know.

-- 
paul-moore.com