lkml.org 
[lkml]   [1996]   [Oct]   [18]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
Subjectt bit and symlinks patch
Date
Here is an implementation of my proposal for fixing the
"symlink-in-/tmp" style of security hole.

Please let me know if you can see any problems with this patch, or a
better way of doing it.

This patch is against kernel 2.0.22 but should work with any recent
kernel.

Cheers, Andrew



--- linux/fs/namei.c.orig Fri Oct 18 22:21:43 1996
+++ linux/fs/namei.c Fri Oct 18 22:07:06 1996
@@ -17,6 +17,7 @@
#include <linux/fcntl.h>
#include <linux/stat.h>
#include <linux/mm.h>
+#include <linux/config.h>

#define ACC_MODE(x) ("\000\004\002\006"[(x)&O_ACCMODE])

@@ -205,6 +206,20 @@
*res_inode = inode;
return 0;
}
+#ifdef CONFIG_SYMLINK_FIX
+ /* don't follow links in directories that have the t bit set
+ if the fsuid != the owner of the link. This stops all
+ the nasty "symlink-in-/tmp" security holes. Note
+ that this explicitly includes root (tridge)
+ */
+ if (S_ISLNK(inode->i_mode) && (dir->i_mode & S_ISVTX) &&
+ current->fsuid != inode->i_uid) {
+ iput(dir);
+ iput(inode);
+ *res_inode = NULL;
+ return -EPERM;
+ }
+#endif
return inode->i_op->follow_link(dir,inode,flag,mode,res_inode);
}

--- linux/fs/Config.in.orig Fri Oct 18 22:21:24 1996
+++ linux/fs/Config.in Fri Oct 18 22:06:10 1996
@@ -6,6 +6,7 @@

bool 'Quota support' CONFIG_QUOTA
bool 'Mandatory lock support' CONFIG_LOCK_MANDATORY
+bool 'Symlink security fix' CONFIG_SYMLINK_FIX
tristate 'Minix fs support' CONFIG_MINIX_FS
tristate 'Extended fs support' CONFIG_EXT_FS
tristate 'Second extended fs support' CONFIG_EXT2_FS
--- linux/Documentation/Configure.help.orig Fri Oct 18 22:22:23 1996
+++ linux/Documentation/Configure.help Fri Oct 18 22:13:16 1996
@@ -2798,6 +2798,17 @@
writing none of these are available. So it's safest to say N here
unless you really know that you need this feature.

+Symlink security fix
+CONFIG_SYMLINK_FIX
+ A very common class of security hole on unix-like systems involves a
+ malicious user creating a symbolic link in /tmp pointing
+ at another users file (often a file owned by root). When the victim
+ then writes to that file they inadvertently write to the wrong file.
+ Enabling this option fixes this class of security hole by preventing
+ a process from following a link which is in a directory with the t bit
+ set unless they own the link.
+ It is highly recommended that you say yes to this option.
+
Minix fs support
CONFIG_MINIX_FS
Minix is a simple operating system used in many classes about
\
 
 \ /
  Last update: 2005-03-22 13:37    [W:0.069 / U:3.472 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site