Switch to prepare_creds/commit_creds (#2631)

Update API as per kernel doc recommends, also fix setup_groups refcount
leak while at it.
This commit is contained in:
Wang Han
2025-06-12 14:26:53 +08:00
committed by GitHub
parent 0b6998b474
commit 5bbac4e84d

View File

@@ -108,6 +108,7 @@ static void setup_groups(struct root_profile *profile, struct cred *cred)
groups_sort(group_info); groups_sort(group_info);
set_groups(cred, group_info); set_groups(cred, group_info);
put_group_info(group_info);
} }
static void disable_seccomp() static void disable_seccomp()
@@ -132,18 +133,18 @@ void escape_to_root(void)
{ {
struct cred *cred; struct cred *cred;
rcu_read_lock(); cred = prepare_creds();
if (!cred) {
do { pr_warn("prepare_creds failed!\n");
cred = (struct cred *)__task_cred((current)); return;
BUG_ON(!cred); }
} while (!get_cred_rcu(cred));
if (cred->euid.val == 0) { if (cred->euid.val == 0) {
pr_warn("Already root, don't escape!\n"); pr_warn("Already root, don't escape!\n");
rcu_read_unlock(); abort_creds(cred);
return; return;
} }
struct root_profile *profile = ksu_get_root_profile(cred->uid.val); struct root_profile *profile = ksu_get_root_profile(cred->uid.val);
cred->uid.val = profile->uid; cred->uid.val = profile->uid;
@@ -174,7 +175,7 @@ void escape_to_root(void)
setup_groups(profile, cred); setup_groups(profile, cred);
rcu_read_unlock(); commit_creds(cred);
// Refer to kernel/seccomp.c: seccomp_set_mode_strict // Refer to kernel/seccomp.c: seccomp_set_mode_strict
// When disabling Seccomp, ensure that current->sighand->siglock is held during the operation. // When disabling Seccomp, ensure that current->sighand->siglock is held during the operation.
@@ -241,7 +242,7 @@ static void nuke_ext4_sysfs() {
} }
ext4_unregister_sysfs(sb); ext4_unregister_sysfs(sb);
path_put(&path); path_put(&path);
} }
int ksu_handle_prctl(int option, unsigned long arg2, unsigned long arg3, int ksu_handle_prctl(int option, unsigned long arg2, unsigned long arg3,