lkml.org 
[lkml]   [2004]   [Feb]   [12]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Subject[PATCH] calculating interpreter's credentials - binfmt_misc 2.6.3-rc1-mm1
Date
From
This patch allows for misc binaries to run with credentials and security
token that are calculated according to the binaries, and not according
to
the interpreter, which is the legacy behavior of binfmt_misc. The way it
is done is by calling prepare_binprm, which is where these attributes
are
calculated, before switching the 'file' field in the bprm from the
binary
to the interpreter. This feature should be used with care, since the
interpreter will have root permissions when running a setuid binary
owned
by root. Please note -
*) Only root can register an interpreter with binfmt_misc
*) The feature is documented and the administrator is advised to handle
it
with care
*) The new feature is enabled only with a special flag in the
registration
string. When this flag is not specified the current behavior of
binfmt_misc
is kept
*) The use of this feature implies the use of the 'open-binary' feature
(see '[PATCH]: non-readable binaries - binfmt_misc 2.6.0' from Jan.
15),
so that the binary cannot be replaced 'underneath the feet' of the
interpreter
*) This is the only 'right' way for an interpreter to know the correct
AT_SECURE value for the interpreted binary

The patch is against 2.6.3-rc1-mm1 (it's also attached in case the lines
get broken) :

----------------- BEGIN PATCH -----------------------
diff -rupN linux-2.6.3-rc1-mm1/Documentation/binfmt_misc.txt
linux/Documentation/binfmt_misc.txt
--- linux-2.6.3-rc1-mm1/Documentation/binfmt_misc.txt 2004-02-05
13:41:26.000000000 +0200
+++ linux/Documentation/binfmt_misc.txt 2004-02-10 12:24:16.169483921
+0200
@@ -46,8 +46,15 @@ Here is what the fields mean:
included, binfmt_misc will open the file for reading and
pass its
descriptor as an argument, instead of the full path, thus
allowing
the interpreter to execute non-readable binaries. This
feature should
- be used with care - the interpreter has to be trusted not
to emit
- the contents of the non-readable binary.
+ be used with care - the interpreter has to be trusted not
to emit
+ the contents of the non-readable binary.



There are some restrictions:
diff -rupN linux-2.6.3-rc1-mm1/fs/binfmt_misc.c linux/fs/binfmt_misc.c
--- linux-2.6.3-rc1-mm1/fs/binfmt_misc.c 2004-02-05
13:41:06.000000000 +0200
+++ linux/fs/binfmt_misc.c 2004-02-10 12:23:58.174611486 +0200
@@ -39,6 +39,7 @@ static int enabled = 1;
enum {Enabled, Magic};
#define MISC_FMT_PRESERVE_ARGV0 (1<<31)
#define MISC_FMT_OPEN_BINARY (1<<30)
+#define MISC_FMT_CREDENTIALS (1<<29)

typedef struct {
struct list_head list;
@@ -171,8 +172,20 @@ static int load_misc_binary(struct linux


binary_file = bprm->file;
- bprm->file = interp_file;
- retval = prepare_binprm (bprm);
+ if (fmt->flags & MISC_FMT_CREDENTIALS) {
+ /* call prepare_binprm before switching to interpreter's
file
+ * so that all security calculation will be done
according to
+ * binary and not interpreter */
+ retval = prepare_binprm (bprm);
+ if (retval < 0)
+ goto _error;
+ bprm->file = interp_file;
+ memset (bprm->buf, 0, BINPRM_BUF_SIZE);
+ retval = kernel_read (bprm->file, 0, bprm->buf,
BINPRM_BUF_SIZE);
+ } else {
+ bprm->file = interp_file;
+ retval = prepare_binprm (bprm);
+ }

if (retval < 0)
goto _error;
@@ -270,6 +283,13 @@ static inline char * check_special_flags
p++;
e->flags |= MISC_FMT_OPEN_BINARY;
break;
+ case 'C':
+ p++;
+ /* this flags also implies the
+ open-binary flag */
+ e->flags |= (MISC_FMT_CREDENTIALS |
+ MISC_FMT_OPEN_BINARY);
+ break;
default:
cont = 0;
}
@@ -452,6 +472,9 @@ static void entry_status(Node *e, char *
if (e->flags & MISC_FMT_OPEN_BINARY) {
*dp ++ = 'O';
}
+ if (e->flags & MISC_FMT_CREDENTIALS) {
+ *dp ++ = 'C';
+ }
*dp ++ = '\n';


----------------- END PATCH -----------------------
Yoav Zach
IA-32 Execution Layer
Performance Tools Lab
Intel Corp.

[unhandled content-type:application/octet-stream]
\
 
 \ /
  Last update: 2005-03-22 14:00    [W:0.039 / U:0.472 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site