Messages in this thread Patch in this message | | | Date | Fri, 28 Jul 2006 01:21:11 +0800 | From | Eugene Teo <> | Subject | Re: Require mmap handler for a.out executables |
| |
Christoph Hellwig wrote: >> diff --git a/fs/binfmt_aout.c b/fs/binfmt_aout.c >> index f312103..5638acf 100644 >> --- a/fs/binfmt_aout.c >> +++ b/fs/binfmt_aout.c >> @@ -278,6 +278,9 @@ static int load_aout_binary(struct linux >> return -ENOEXEC; >> } >> >> + if (!bprm->file->f_op || !bprm->file->f_op->mmap) >> + return -ENOEXEC; >> + > > These checks need a big comment explanining why they are there, else people > will remove them again by accident.
Here's a resend.
Like what Marcel wrote, Andrew, please include this patch in -mm for testing. Thanks.
Eugene --
[PATCH] Require mmap handler for a.out executables
Files supported by fs/proc/base.c, i.e. /proc/<pid>/*, are not capable of meeting the validity checks in ELF load_elf_*() handling because they have no mmap handler which is required by ELF. In order to stop a.out executables being used as part of an exploit attack against /proc-related vulnerabilities, we make a.out executables depend on ->mmap() existing.
Signed-off-by: Eugene Teo <eteo@redhat.com> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
diff --git a/fs/binfmt_aout.c b/fs/binfmt_aout.c index f312103..2042dfa 100644 --- a/fs/binfmt_aout.c +++ b/fs/binfmt_aout.c @@ -278,6 +278,12 @@ static int load_aout_binary(struct linux return -ENOEXEC; }
+ /* Requires a mmap handler. This prevents people from using a.out + * as part of an exploit attack against /proc-related vulnerabilities. + */ + if (!bprm->file->f_op || !bprm->file->f_op->mmap) + return -ENOEXEC; + fd_offset = N_TXTOFF(ex);
/* Check initial limits. This avoids letting people circumvent @@ -476,6 +482,12 @@ static int load_aout_library(struct file goto out; }
+ /* Requires a mmap handler. This prevents people from using a.out + * as part of an exploit attack against /proc-related vulnerabilities. + */ + if (!file->f_op || !file->f_op->mmap) + goto out; + if (N_FLAGS(ex)) goto out;
-- eteo redhat.com ph: +65 6490 4142 http://www.kernel.org/~eugeneteo gpg fingerprint: 47B9 90F6 AE4A 9C51 37E0 D6E1 EA84 C6A2 58DF 8823 - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |