2019-05-27 08:55:01 +02:00
|
|
|
|
2011-10-31 17:06:39 -07:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2020-10-27 19:22:46 +01:00
|
|
|
|
2011-10-31 17:06:39 -07:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2017-02-08 18:51:29 +01:00
|
|
|
|
2011-10-31 17:06:39 -07:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2014-02-05 13:25:32 -05:00
|
|
|
|
2018-02-06 15:42:16 -08:00
|
|
|
|
2011-10-31 17:06:39 -07:00
|
|
|
|
2014-02-05 13:25:32 -05:00
|
|
|
|
2011-10-31 17:06:39 -07:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2014-02-05 12:44:24 -05:00
|
|
|
|
|
|
|
|
|
2014-02-05 12:55:11 -05:00
|
|
|
|
2014-02-05 11:51:53 -05:00
|
|
|
|
2014-02-05 13:15:28 -05:00
|
|
|
|
2011-10-31 17:06:39 -07:00
|
|
|
|
|
|
|
|
|
2014-02-05 13:15:28 -05:00
|
|
|
|
2014-02-05 12:44:24 -05:00
|
|
|
|
2014-02-05 12:55:11 -05:00
|
|
|
|
2014-02-05 12:44:24 -05:00
|
|
|
|
2011-10-31 17:06:39 -07:00
|
|
|
|
2014-02-05 12:55:11 -05:00
|
|
|
|
|
|
|
|
|
2011-10-31 17:06:39 -07:00
|
|
|
|
2020-01-30 22:13:05 -08:00
|
|
|
|
2014-04-10 20:54:51 -04:00
|
|
|
|
2020-01-30 22:13:05 -08:00
|
|
|
|
2014-02-05 12:44:24 -05:00
|
|
|
|
2020-01-30 22:13:05 -08:00
|
|
|
|
2014-02-05 12:44:24 -05:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2011-10-31 17:06:39 -07:00
|
|
|
|
2014-02-05 12:44:24 -05:00
|
|
|
|
2011-10-31 17:06:39 -07:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2023-11-11 19:48:59 +01:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2011-10-31 17:06:39 -07:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2014-02-05 13:25:32 -05:00
|
|
|
|
2011-10-31 17:06:39 -07:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2014-02-05 11:51:53 -05:00
|
|
|
|
2011-10-31 17:06:39 -07:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2014-02-05 13:15:28 -05:00
|
|
|
|
2011-10-31 17:06:39 -07:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2016-12-14 15:06:55 -08:00
|
|
|
|
2011-10-31 17:06:39 -07:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2016-10-13 01:20:12 +01:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2014-02-05 13:25:32 -05:00
|
|
|
|
2023-11-11 19:48:59 +01:00
|
|
|
|
2016-12-14 15:06:55 -08:00
|
|
|
|
2014-02-05 13:25:32 -05:00
|
|
|
|
2011-10-31 17:06:39 -07:00
|
|
|
|
2016-02-12 13:01:54 -08:00
|
|
|
|
|
|
|
|
|
2016-12-14 15:06:55 -08:00
|
|
|
|
2016-02-12 13:01:54 -08:00
|
|
|
|
|
|
|
|
|
2020-06-08 21:33:25 -07:00
|
|
|
|
2020-08-11 18:39:01 -07:00
|
|
|
|
2020-01-30 22:13:05 -08:00
|
|
|
|
2023-05-17 20:25:36 +01:00
|
|
|
|
2016-12-14 15:06:55 -08:00
|
|
|
|
2020-06-08 21:33:25 -07:00
|
|
|
|
2020-01-30 22:13:05 -08:00
|
|
|
|
2014-02-05 12:44:24 -05:00
|
|
|
|
|
|
|
|
|
2020-01-30 22:13:05 -08:00
|
|
|
|
2014-02-05 13:25:32 -05:00
|
|
|
|
|
|
|
|
|
2014-02-05 12:55:11 -05:00
|
|
|
|
2014-02-05 12:44:24 -05:00
|
|
|
|
2014-02-05 13:25:32 -05:00
|
|
|
|
2014-02-05 13:15:28 -05:00
|
|
|
|
2014-02-05 13:25:32 -05:00
|
|
|
|
2011-10-31 17:06:39 -07:00
|
|
|
|
2020-01-30 22:13:05 -08:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2020-01-30 22:13:35 -08:00
|
|
|
|
|
|
|
|
|
2011-10-31 17:06:39 -07:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2014-02-05 13:25:32 -05:00
|
|
|
|
2011-10-31 17:06:39 -07:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2018-02-06 15:42:19 -08:00
|
|
|
|
2011-10-31 17:06:39 -07:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2014-02-05 11:51:53 -05:00
|
|
|
|
2011-10-31 17:06:39 -07:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2014-02-05 13:15:28 -05:00
|
|
|
|
2011-10-31 17:06:39 -07:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2023-11-11 19:48:59 +01:00
|
|
|
|
2011-10-31 17:06:39 -07:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2023-11-11 19:48:59 +01:00
|
|
|
|
|
|
|
|
|
2011-10-31 17:06:39 -07:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2018-02-06 15:40:17 -08:00
|
|
|
|
2011-10-31 17:06:39 -07:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
ptrace: use fsuid, fsgid, effective creds for fs access checks
By checking the effective credentials instead of the real UID / permitted
capabilities, ensure that the calling process actually intended to use its
credentials.
To ensure that all ptrace checks use the correct caller credentials (e.g.
in case out-of-tree code or newly added code omits the PTRACE_MODE_*CREDS
flag), use two new flags and require one of them to be set.
The problem was that when a privileged task had temporarily dropped its
privileges, e.g. by calling setreuid(0, user_uid), with the intent to
perform following syscalls with the credentials of a user, it still passed
ptrace access checks that the user would not be able to pass.
While an attacker should not be able to convince the privileged task to
perform a ptrace() syscall, this is a problem because the ptrace access
check is reused for things in procfs.
In particular, the following somewhat interesting procfs entries only rely
on ptrace access checks:
/proc/$pid/stat - uses the check for determining whether pointers
should be visible, useful for bypassing ASLR
/proc/$pid/maps - also useful for bypassing ASLR
/proc/$pid/cwd - useful for gaining access to restricted
directories that contain files with lax permissions, e.g. in
this scenario:
lrwxrwxrwx root root /proc/13020/cwd -> /root/foobar
drwx------ root root /root
drwxr-xr-x root root /root/foobar
-rw-r--r-- root root /root/foobar/secret
Therefore, on a system where a root-owned mode 6755 binary changes its
effective credentials as described and then dumps a user-specified file,
this could be used by an attacker to reveal the memory layout of root's
processes or reveal the contents of files he is not allowed to access
(through /proc/$pid/cwd).
[akpm@linux-foundation.org: fix warning]
Signed-off-by: Jann Horn <jann@thejh.net>
Acked-by: Kees Cook <keescook@chromium.org>
Cc: Casey Schaufler <casey@schaufler-ca.com>
Cc: Oleg Nesterov <oleg@redhat.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: James Morris <james.l.morris@oracle.com>
Cc: "Serge E. Hallyn" <serge.hallyn@ubuntu.com>
Cc: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: "Eric W. Biederman" <ebiederm@xmission.com>
Cc: Willy Tarreau <w@1wt.eu>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2016-01-20 15:00:04 -08:00
|
|
|
|
2024-09-24 21:10:23 +01:00
|
|
|
|
|
|
|
|
|
2012-02-02 11:34:09 +10:30
|
|
|
|
2020-03-20 21:26:34 +01:00
|
|
|
|
2012-02-02 11:34:09 +10:30
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2011-10-31 17:06:39 -07:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2014-02-05 13:15:28 -05:00
|
|
|
|
2011-10-31 17:06:39 -07:00
|
|
|
|
|
|
|
|
|
2014-02-05 13:15:28 -05:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2011-10-31 17:06:39 -07:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2018-02-06 15:42:19 -08:00
|
|
|
|
2011-10-31 17:06:39 -07:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2020-12-14 19:14:25 -08:00
|
|
|
|
2014-02-05 11:51:53 -05:00
|
|
|
|
2011-10-31 17:06:39 -07:00
|
|
|
|
2022-09-15 20:25:47 -04:00
|
|
|
|
2011-10-31 17:06:39 -07:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2015-03-21 14:47:11 -04:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2020-09-25 06:51:40 +02:00
|
|
|
|
2020-10-26 18:03:18 -06:00
|
|
|
|
|
|
|
|
|
2020-09-25 06:51:40 +02:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2014-02-05 11:51:53 -05:00
|
|
|
|
2011-10-31 17:06:39 -07:00
|
|
|
|
|
|
|
|
|
2020-09-25 06:51:40 +02:00
|
|
|
|
2015-03-21 14:47:11 -04:00
|
|
|
|
2011-10-31 17:06:39 -07:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|