kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-18 19:12:56 +00:00
Code Issues Releases Packages Activity
linux/fs
History
Jann Horn 229aba441e ptrace: use fsuid, fsgid, effective creds for fs access checks 
commit caaee6234d upstream.

By checking the effective credentials instead of the real UID / permitted
capabilities, ensure that the calling process actually intended to use its
credentials.

To ensure that all ptrace checks use the correct caller credentials (e.g.
in case out-of-tree code or newly added code omits the PTRACE_MODE_*CREDS
flag), use two new flags and require one of them to be set.

The problem was that when a privileged task had temporarily dropped its
privileges, e.g.  by calling setreuid(0, user_uid), with the intent to
perform following syscalls with the credentials of a user, it still passed
ptrace access checks that the user would not be able to pass.

While an attacker should not be able to convince the privileged task to
perform a ptrace() syscall, this is a problem because the ptrace access
check is reused for things in procfs.

In particular, the following somewhat interesting procfs entries only rely
on ptrace access checks:

 /proc/$pid/stat - uses the check for determining whether pointers
     should be visible, useful for bypassing ASLR
 /proc/$pid/maps - also useful for bypassing ASLR
 /proc/$pid/cwd - useful for gaining access to restricted
     directories that contain files with lax permissions, e.g. in
     this scenario:
     lrwxrwxrwx root root /proc/13020/cwd -> /root/foobar
     drwx------ root root /root
     drwxr-xr-x root root /root/foobar
     -rw-r--r-- root root /root/foobar/secret

Therefore, on a system where a root-owned mode 6755 binary changes its
effective credentials as described and then dumps a user-specified file,
this could be used by an attacker to reveal the memory layout of root's
processes or reveal the contents of files he is not allowed to access
(through /proc/$pid/cwd).

[akpm@linux-foundation.org: fix warning]
Signed-off-by: Jann Horn <jann@thejh.net>
Acked-by: Kees Cook <keescook@chromium.org>
Cc: Casey Schaufler <casey@schaufler-ca.com>
Cc: Oleg Nesterov <oleg@redhat.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: James Morris <james.l.morris@oracle.com>
Cc: "Serge E. Hallyn" <serge.hallyn@ubuntu.com>
Cc: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: "Eric W. Biederman" <ebiederm@xmission.com>
Cc: Willy Tarreau <w@1wt.eu>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
[bwh: Backported to 3.16:
 - Update mm_access() calls in fs/proc/task_{,no}mmu.c too
 - Adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
History 2017-09-15 18:30:17 +01:00
..
9p fs: Give dentry to inode_change_ok() instead of inode 2017-02-23 03:53:52 +00:00
adfs fs: Give dentry to inode_change_ok() instead of inode 2017-02-23 03:53:52 +00:00
affs fs: Give dentry to inode_change_ok() instead of inode 2017-02-23 03:53:52 +00:00
afs AFS: Correctly assemble the client UUID 2014-07-29 10:14:36 -07:00
autofs4 autofs: sanity check status reported with AUTOFS_DEV_IOCTL_FAIL 2017-09-15 18:30:15 +01:00
befs fs/befs: kernel-doc fixes 2014-06-06 16:08:09 -07:00
bfs write_iter variants of {__,}generic_file_aio_write() 2014-05-06 17:38:00 -04:00
btrfs btrfs: fix memory leak in update_space_info failure path 2017-09-15 18:29:54 +01:00
cachefiles FS-Cache: Add missing initialization of ret in cachefiles_write_page() 2015-12-18 16:06:16 +00:00
ceph ceph: fix memory leak in __ceph_setxattr() 2017-08-26 02:14:46 +01:00
cifs CIFS: Improve readdir verbosity 2017-09-15 18:30:13 +01:00
coda move d_rcu from overlapping d_child to overlapping d_alias 2015-01-15 10:44:58 +00:00
configfs configfs: Fix race between create_link and configfs_rmdir 2017-09-15 18:30:09 +01:00
cramfs Major changes for 3.14 include support for the newly added ZERO_RANGE 2014-04-04 15:39:39 -07:00
debugfs dentry name snapshots 2017-08-26 02:14:48 +01:00
devpts pty: make sure super_block is still valid in final /dev/tty close 2016-02-25 10:34:48 +00:00
dlm dlm: keep listening connection alive with sctp mode 2014-06-12 10:26:14 -05:00
ecryptfs fs: Give dentry to inode_change_ok() instead of inode 2017-02-23 03:53:52 +00:00
efivarfs efi: Make efivarfs entries immutable by default 2016-03-24 10:01:20 +00:00
efs fs/efs: convert printk(KERN_DEBUG to pr_debug 2014-06-04 16:54:21 -07:00
exofs fs: Give dentry to inode_change_ok() instead of inode 2017-02-23 03:53:52 +00:00
exportfs move d_rcu from overlapping d_child to overlapping d_alias 2015-01-15 10:44:58 +00:00
ext2 fs: Give dentry to inode_change_ok() instead of inode 2017-02-23 03:53:52 +00:00
ext3 fs: Give dentry to inode_change_ok() instead of inode 2017-02-23 03:53:52 +00:00
ext4 ext4: fix fdatasync(2) after extent manipulation operations 2017-09-15 18:29:52 +01:00
f2fs f2fs: add ovp valid_blocks check for bg gc victim to fg_gc 2017-06-05 21:17:15 +01:00
fat fs: Give dentry to inode_change_ok() instead of inode 2017-02-23 03:53:52 +00:00
freevxfs Major changes for 3.14 include support for the newly added ZERO_RANGE 2014-04-04 15:39:39 -07:00
fscache FS-Cache: Handle a write to the page immediately beyond the EOF marker 2015-12-13 17:49:53 +00:00
fuse fuse: add missing FR_FORCE 2017-06-05 21:17:13 +01:00
gfs2 fs: Give dentry to inode_change_ok() instead of inode 2017-02-23 03:53:52 +00:00
hfs fs: Give dentry to inode_change_ok() instead of inode 2017-02-23 03:53:52 +00:00
hfsplus fs: Give dentry to inode_change_ok() instead of inode 2017-02-23 03:53:52 +00:00
hostfs fs: Give dentry to inode_change_ok() instead of inode 2017-02-23 03:53:52 +00:00
hpfs fs: Give dentry to inode_change_ok() instead of inode 2017-02-23 03:53:52 +00:00
hppfs clean up scary strncpy(dst, src, strlen(src)) uses 2013-07-03 16:07:41 -07:00
hugetlbfs mm: larger stack guard gap, between vmas 2017-07-02 17:13:02 +01:00
isofs isofs: Do not return EACCES for unknown filesystems 2017-02-23 03:54:17 +00:00
jbd fs/jbd/revoke.c: replace shift loop by ilog2 2014-05-21 10:26:13 +02:00
jbd2 jbd2: don't leak modified metadata buffers on an aborted journal 2017-06-05 21:17:03 +01:00
jffs2 fs: Give dentry to inode_change_ok() instead of inode 2017-02-23 03:53:52 +00:00
jfs fs: Give dentry to inode_change_ok() instead of inode 2017-02-23 03:53:52 +00:00
kernfs fs: Give dentry to inode_change_ok() instead of inode 2017-02-23 03:53:52 +00:00
lockd lockd: create NSM handles per net namespace 2015-12-13 17:48:43 +00:00
logfs fs: Give dentry to inode_change_ok() instead of inode 2017-02-23 03:53:52 +00:00
minix fs: Give dentry to inode_change_ok() instead of inode 2017-02-23 03:53:52 +00:00
ncpfs fs: Give dentry to inode_change_ok() instead of inode 2017-02-23 03:53:52 +00:00
nfs NFS: Use GFP_NOIO for two allocations in writeback 2017-08-26 02:14:37 +01:00
nfs_common nfs_common: Update the translation between nfsv3 acls linux posix acls 2013-02-13 06:15:14 -08:00
nfsd ima: pass 'opened' flag to identify newly created files 2017-08-26 02:14:23 +01:00
nilfs2 fs: Give dentry to inode_change_ok() instead of inode 2017-02-23 03:53:52 +00:00
nls nls: have register_nls() set ->owner 2014-01-25 03:14:05 -05:00
notify dentry name snapshots 2017-08-26 02:14:48 +01:00
ntfs fs: Give dentry to inode_change_ok() instead of inode 2017-02-23 03:53:52 +00:00
ocfs2 ocfs2: fix crash caused by stale lvb with fsdlm plugin 2017-03-16 02:26:55 +00:00
omfs fs: Give dentry to inode_change_ok() instead of inode 2017-02-23 03:53:52 +00:00
openpromfs fs: push sync_filesystem() down to the file system's remount_fs() 2014-03-13 10:14:33 -04:00
proc ptrace: use fsuid, fsgid, effective creds for fs access checks 2017-09-15 18:30:17 +01:00
pstore pstore/ram: Use memcpy_fromio() to save old buffer 2017-02-23 03:53:59 +00:00
qnx4 fs: push sync_filesystem() down to the file system's remount_fs() 2014-03-13 10:14:33 -04:00
qnx6 fs: push sync_filesystem() down to the file system's remount_fs() 2014-03-13 10:14:33 -04:00
quota quota: Store maximum space limit in bytes 2015-03-04 17:28:02 +00:00
ramfs fs: Give dentry to inode_change_ok() instead of inode 2017-02-23 03:53:52 +00:00
reiserfs reiserfs: Unlock superblock before calling reiserfs_quota_on_mount() 2017-02-23 03:54:00 +00:00
romfs switch simple generic_file_aio_read() users to ->read_iter() 2014-05-06 17:37:55 -04:00
squashfs fs/squashfs/squashfs.h: replace pr_warning by pr_warn 2014-06-04 16:53:52 -07:00
sysfs vfs: Commit to never having exectuables on proc and sysfs. 2017-04-04 22:21:56 +01:00
sysv fs: Give dentry to inode_change_ok() instead of inode 2017-02-23 03:53:52 +00:00
ubifs ubifs: Fix journal replay wrt. xattr nodes 2017-03-16 02:27:00 +00:00
udf fs: Give dentry to inode_change_ok() instead of inode 2017-02-23 03:53:52 +00:00
ufs excessive checks in ufs_write_failed() and ufs_evict_inode() 2017-09-15 18:30:08 +01:00
xfs xfs: Fix missed holes in SEEK_HOLE implementation 2017-09-15 18:29:51 +01:00
aio.c aio: mark AIO pseudo-fs noexec 2017-04-04 22:21:57 +01:00
anon_inodes.c vfs: Allocate anon_inode_inode in anon_inode_init() 2014-03-27 09:52:54 -07:00
attr.c fs: Give dentry to inode_change_ok() instead of inode 2017-02-23 03:53:52 +00:00
bad_inode.c [readdir] ->readdir() is gone 2013-06-29 12:57:04 +04:00
binfmt_aout.c dump_skip(): dump_seek() replacement taking coredump_params 2013-11-09 00:16:26 -05:00
binfmt_elf.c binfmt_elf: Don't clobber passed executable's file header 2015-12-13 17:49:24 +00:00
binfmt_elf_fdpic.c elf{,_fdpic} coredump: get rid of pointless if (siginfo->si_signo) 2013-11-09 00:16:30 -05:00
binfmt_em86.c file->f_op is never NULL... 2013-10-24 23:34:54 -04:00
binfmt_flat.c fs/binfmt_flat.c: make old_reloc() static 2014-06-04 16:54:21 -07:00
binfmt_misc.c binfmt_misc: add missing 'break' statement 2014-04-03 16:21:16 -07:00
binfmt_script.c exec: do not leave bprm->interp on stack 2012-12-20 17:40:19 -08:00
binfmt_som.c get rid of pt_regs argument of ->load_binary() 2012-11-28 21:53:38 -05:00
block_dev.c block_dev: don't test bdev->bd_contains when it is not stable 2017-03-16 02:26:36 +00:00
buffer.c fs/buffer.c: support buffer cache allocations with gfp modifiers 2015-08-27 14:53:36 +01:00
char_dev.c Merge branch 'for-3.13/core' of git://git.kernel.dk/linux-block 2013-11-14 12:08:14 +09:00
compat.c fs: namespace: suppress 'may be used uninitialized' warnings 2017-04-04 22:21:52 +01:00
compat_binfmt_elf.c binfmt_elf: add ELF_HWCAP2 to compat auxv entries 2014-03-04 08:05:21 +00:00
compat_ioctl.c fs/compat: convert to COMPAT_SYSCALL_DEFINE with changing parameter types 2014-03-06 16:30:44 +01:00
coredump.c coredump: fix unfreezable coredumping task 2017-02-23 03:54:32 +00:00
dcache.c dentry name snapshots 2017-08-26 02:14:48 +01:00
dcookies.c fs/compat: fix lookup_dcookie() parameter handling 2014-01-29 16:22:40 -08:00
direct-io.c fuse: honour max_read and max_write in direct_io mode 2014-11-03 10:46:27 +00:00
drop_caches.c fs: convert use of typedef ctl_table to struct ctl_table 2014-06-06 16:08:16 -07:00
eventfd.c eventfd_ctx_fdget(): use fdget() instead of fget() 2014-01-25 03:13:04 -05:00
eventpoll.c eventpoll: fix uninitialized variable in epoll_ctl 2014-10-05 13:41:07 -07:00
exec.c fs/exec.c: account for argv/envp pointers 2017-07-18 18:40:40 +01:00
fcntl.c locks: rename file-private locks to "open file description locks" 2014-04-22 08:23:58 -04:00
fhandle.c fs/coredump: prevent fsuid=0 dumps into user-controlled directories 2016-05-01 00:06:04 +02:00
file.c fs/file.c: don't open-code kvfree() 2014-05-06 17:31:10 -04:00
file_table.c Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2014-06-12 10:30:18 -07:00
filesystems.c sys_sysfs: Add CONFIG_SYSFS_SYSCALL 2014-04-03 16:21:05 -07:00
fs-writeback.c writeback: fix a subtle race condition in I_DIRTY clearing 2015-01-05 13:48:34 +00:00
fs_struct.c seqcount: Add lockdep functionality to seqcount/seqlock structures 2013-11-06 12:40:26 +01:00
inode.c fs: Fix S_NOSEC handling 2015-07-15 10:00:50 +01:00
internal.h fs: namespace: suppress 'may be used uninitialized' warnings 2017-04-04 22:21:52 +01:00
ioctl.c file->f_op is never NULL... 2013-10-24 23:34:54 -04:00
Kconfig kernfs: add CONFIG_KERNFS 2014-02-07 16:08:57 -08:00
Kconfig.binfmt fs: make binfmt support for #! scripts modular and removable 2013-04-30 17:04:04 -07:00
libfs.c fs: Give dentry to inode_change_ok() instead of inode 2017-02-23 03:53:52 +00:00
locks.c locks: fix unlock when fcntl_setlk races with a close 2016-02-02 19:09:20 +00:00
Makefile block: move ioprio.c from fs/ to block/ 2014-05-19 11:02:18 -06:00
mbcache.c fs/mbcache: replace __builtin_log2() with ilog2() 2014-06-25 22:08:29 -04:00
mount.h mnt: Add a per mount namespace limit on the number of mounts 2017-02-26 20:01:48 +00:00
mpage.c fs/block_dev.c: add bdev_read_page() and bdev_write_page() 2014-06-04 16:54:02 -07:00
namei.c dentry name snapshots 2017-08-26 02:14:48 +01:00
namespace.c fs: namespace: suppress 'may be used uninitialized' warnings 2017-04-04 22:21:52 +01:00
no-block.c llseek: automatically add .llseek fop 2010-10-15 15:53:27 +02:00
open.c vfs: Commit to never having exectuables on proc and sysfs. 2017-04-04 22:21:56 +01:00
pipe.c pipe: limit the per-user amount of pages allocated in pipes 2016-02-25 10:51:03 +00:00
pnode.c mnt: Add a per mount namespace limit on the number of mounts 2017-02-26 20:01:48 +00:00
pnode.h mnt: Add a per mount namespace limit on the number of mounts 2017-02-26 20:01:48 +00:00
posix_acl.c tmpfs: clear S_ISGID when setting posix ACLs 2017-02-26 20:01:49 +00:00
proc_namespace.c vfs: show_vfsstat: do not ignore errors from show_devname method 2016-05-01 00:06:01 +02:00
read_write.c switch simple generic_file_aio_read() users to ->read_iter() 2014-05-06 17:37:55 -04:00
readdir.c fanotify: create FAN_ACCESS event for readdir 2014-06-04 16:53:52 -07:00
select.c Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2013-11-13 15:34:18 +09:00
seq_file.c fs/seq_file: fix out-of-bounds read 2016-11-20 01:17:18 +00:00
signalfd.c signalfd: fix information leak in signalfd_copyinfo 2015-09-03 16:43:54 +01:00
splice.c vfs: fix uninitialized flags in splice_to_pipe() 2017-03-16 02:27:14 +00:00
stack.c fs: reduce the use of module.h wherever possible 2012-02-28 19:31:58 -05:00
stat.c ufs: restore maintaining ->i_blocks 2017-09-15 18:30:08 +01:00
statfs.c vfs: allow O_PATH file descriptors for fstatfs() 2013-10-12 13:12:31 -07:00
super.c fs/super.c: fix race between freeze_super() and thaw_super() 2017-02-23 03:54:13 +00:00
sync.c Revert "writeback: do not sync data dirtied after sync start" 2014-02-22 02:02:28 +01:00
timerfd.c timerfd: Protect the might cancel mechanism proper 2017-08-26 02:14:49 +01:00
utimes.c fs: Give dentry to inode_change_ok() instead of inode 2017-02-23 03:53:52 +00:00
xattr.c fs/xattr.c: zero out memory copied to userspace in getxattr 2017-08-26 02:14:47 +01:00