Update and test for Linux kernel v5.10.14

[skx]

Been a while since I touched this repository; update as appropriate for the latest stable kernel, and make a new tag/release.

[skx]

5.10.17 now!

Will aim to handle Thursday evening (18/02/2021).

[skx]

• Downloaded source to 5.10.17.

• Booted my old virtual machine.

• Copied the config from old to new.

  $ zcat /proc/config.gz >.config
  $ yes "" | make oldconfig

• Copied tree into place:

  $ cd ~/linux-5.10.17/security/
  $ cp ~/linux-security-modules/security/can-exec/ . -R
  $ cp ~/linux-security-modules/security/whitelist/ . -R
  $ cp ~/linux-security-modules/security/hashcheck/ . -R

• Updated security/Kconfig + security/Makefile

  • Only minor change was the addition of bpf in this kernel, or some other recent one.

[skx]

Building now:

   $ make -j6 && make install && make modules_install && update-grub && update-grub2 && update-initramfs -u -k all

[skx]

Building took fifteen minutes:

   real	15m9.794s
   user	42m31.813s
   sys	5m8.429s

System rebooted into new kernel, happily:

   root@stretch:~# uname -r
   5.10.17
   root@stretch:~# uptime
    17:42:29 up 2 min,  1 user,  load average: 0.02, 0.02, 0.00

Module shows as visible:

   root@stretch:~# echo $(cat /sys/kernel/security/lsm)
   capability,can_exec

Can be enabled:

    root@stretch:~# echo 1 > /proc/sys/kernel/can-exec/enabled

Testing as nobody:

    root@stretch:~# su - nobody -s /bin/sh
    No directory, logging in with HOME=/
    $ 
    $ id
    uid=65534(nobody) gid=65534(nogroup) groups=65534(nogroup)
    $ ls
    -su: 3: ls: Operation not permitted

So id worked, but ls was denied. Matches config:

    root@stretch:~# cat /etc/can-exec/nobody.conf 
    /usr/bin/id
    /bin/bash
    /bin/sh
    /bin/dash
    /bin/cat

Logging in /var/log/syslog corresponds as expected:

    Feb 18 17:41:20 stretch can-exec[641]: UID:65534 USER:nobody CMD:/bin/ls
    Feb 18 17:41:20 stretch can-exec[641]: Denying execution of command - no match found.
    Feb 18 17:41:20 stretch kernel: [   58.017893] Return code from user-space was 255

Looks good.