From: Eric W. Biederman <ebiederm@xmission.com>
Date: Mon, 16 Mar 2020 17:21:12 +0000 (-0500)
Subject: exec: Teach prepare_exec_creds how exec treats uids & gids
X-Git-Tag: v5.8-rc1~144^2~4^2~7
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=87b047d2be417b271d80f5e490a825c6fd53ecad;p=thirdparty%2Flinux.git

exec: Teach prepare_exec_creds how exec treats uids & gids

It is almost possible to use the result of prepare_exec_creds with no
modifications during exec.  Update prepare_exec_creds to initialize
the suid and the fsuid to the euid, and the sgid and the fsgid to the
egid.  This is all that is needed to handle the common case of exec
when nothing special like a setuid exec is happening.

That this preserves the existing behavior of exec can be verified
by examing bprm_fill_uid and cap_bprm_set_creds.

This change makes it clear that the later parts of exec that
update bprm->cred are just need to handle special cases such
as setuid exec and change of domains.

Link: https://lkml.kernel.org/r/871rng22dm.fsf_-_@x220.int.ebiederm.org
Acked-by: Linus Torvalds <torvalds@linux-foundation.org>
Reviewed-by: Kees Cook <keescook@chromium.org>
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
---

diff --git a/kernel/cred.c b/kernel/cred.c
index 71a7926169170..421b1149c6516 100644
--- a/kernel/cred.c
+++ b/kernel/cred.c
@@ -315,6 +315,9 @@ struct cred *prepare_exec_creds(void)
 	new->process_keyring = NULL;
 #endif
 
+	new->suid = new->fsuid = new->euid;
+	new->sgid = new->fsgid = new->egid;
+
 	return new;
 }