bpf: Check correct cred for CAP_SYSLOG in bpf_dump_raw_ok()
authorKees Cook <keescook@chromium.org>
Thu, 2 Jul 2020 22:45:23 +0000 (15:45 -0700)
committerKees Cook <keescook@chromium.org>
Wed, 8 Jul 2020 23:01:21 +0000 (16:01 -0700)
commit63960260457a02af2a6cb35d75e6bdb17299c882
treef228a9c11508b12047dba30ae47457d4043955ea
parent60f7bb66b88b649433bf700acfc60c3f24953871
bpf: Check correct cred for CAP_SYSLOG in bpf_dump_raw_ok()

When evaluating access control over kallsyms visibility, credentials at
open() time need to be used, not the "current" creds (though in BPF's
case, this has likely always been the same). Plumb access to associated
file->f_cred down through bpf_dump_raw_ok() and its callers now that
kallsysm_show_value() has been refactored to take struct cred.

Cc: Alexei Starovoitov <ast@kernel.org>
Cc: Daniel Borkmann <daniel@iogearbox.net>
Cc: bpf@vger.kernel.org
Cc: stable@vger.kernel.org
Fixes: 7105e828c087 ("bpf: allow for correlation of maps and helpers in dump")
Signed-off-by: Kees Cook <keescook@chromium.org>
include/linux/filter.h
kernel/bpf/syscall.c
net/core/sysctl_net_core.c