[rsbac-commit] linux-5.10.y 5.10.181 commit 9afae1736497 __sys_setresuid(), __sys_setresgid(): move RSBAC check before no-op

https://git.rsbac.org/cgi-bin/gitweb.cgi?p=linux-5.10.y.git;a=summary

RSBAC for Linux 5.10 (Long Term)

Current version: 5.10.181

commit 9afae17364972a48660438c8025373e5968649c2 Author: Amon Ott ao@rsbac.org Date: Thu Jun 1 08:38:39 2023 +0200

__sys_setresuid(), __sys_setresgid(): move RSBAC check before no-op check. The kernel no-op check bypasses the RSBAC check and notification, but in RSBAC, setresuid(getuid(), -1, -1) is security relevant and needs to update state. As a side effect, we now also check before the kernel capability check and might see more RSBAC messages as a result.

kernel/sys.c | 138 ++++++++++++++++++++++++++++------------------------------- 1 file changed, 66 insertions(+), 72 deletions(-)