summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorCasey Schaufler <casey@schaufler-ca.com>2020-12-22 15:34:24 -0800
committerCasey Schaufler <casey@schaufler-ca.com>2020-12-22 15:34:24 -0800
commit942cb357ae7d9249088e3687ee6a00ed2745a0c7 (patch)
tree2bfffd5812fb64ccb43da0308773525dfda99277
parent9b0072e2b2b588ad75c94f2c6e6c52c8f4bd2657 (diff)
Smack: Handle io_uring kernel thread privileges
Smack assumes that kernel threads are privileged for smackfs operations. This was necessary because the credential of the kernel thread was not related to a user operation. With io_uring the credential does reflect a user's rights and can be used. Suggested-by: Jens Axboe <axboe@kernel.dk> Acked-by: Jens Axboe <axboe@kernel.dk> Acked-by: Eric W. Biederman <ebiederm@xmission.com> Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
-rw-r--r--security/smack/smack_access.c5
1 files changed, 3 insertions, 2 deletions
diff --git a/security/smack/smack_access.c b/security/smack/smack_access.c
index efe2406a3960..7eabb448acab 100644
--- a/security/smack/smack_access.c
+++ b/security/smack/smack_access.c
@@ -688,9 +688,10 @@ bool smack_privileged_cred(int cap, const struct cred *cred)
bool smack_privileged(int cap)
{
/*
- * All kernel tasks are privileged
+ * Kernel threads may not have credentials we can use.
+ * The io_uring kernel threads do have reliable credentials.
*/
- if (unlikely(current->flags & PF_KTHREAD))
+ if ((current->flags & (PF_KTHREAD | PF_IO_WORKER)) == PF_KTHREAD)
return true;
return smack_privileged_cred(cap, current_cred());