lkml.org 
[lkml]   [2016]   [Oct]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.7 132/141] aio: mark AIO pseudo-fs noexec
    Date
    4.7-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Jann Horn <jann@thejh.net>

    commit 22f6b4d34fcf039c63a94e7670e0da24f8575a5a upstream.

    This ensures that do_mmap() won't implicitly make AIO memory mappings
    executable if the READ_IMPLIES_EXEC personality flag is set. Such
    behavior is problematic because the security_mmap_file LSM hook doesn't
    catch this case, potentially permitting an attacker to bypass a W^X
    policy enforced by SELinux.

    I have tested the patch on my machine.

    To test the behavior, compile and run this:

    #define _GNU_SOURCE
    #include <unistd.h>
    #include <sys/personality.h>
    #include <linux/aio_abi.h>
    #include <err.h>
    #include <stdlib.h>
    #include <stdio.h>
    #include <sys/syscall.h>

    int main(void) {
    personality(READ_IMPLIES_EXEC);
    aio_context_t ctx = 0;
    if (syscall(__NR_io_setup, 1, &ctx))
    err(1, "io_setup");

    char cmd[1000];
    sprintf(cmd, "cat /proc/%d/maps | grep -F '/[aio]'",
    (int)getpid());
    system(cmd);
    return 0;
    }

    In the output, "rw-s" is good, "rwxs" is bad.

    Signed-off-by: Jann Horn <jann@thejh.net>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    fs/aio.c | 7 ++++++-
    1 file changed, 6 insertions(+), 1 deletion(-)

    --- a/fs/aio.c
    +++ b/fs/aio.c
    @@ -239,7 +239,12 @@ static struct dentry *aio_mount(struct f
    static const struct dentry_operations ops = {
    .d_dname = simple_dname,
    };
    - return mount_pseudo(fs_type, "aio:", NULL, &ops, AIO_RING_MAGIC);
    + struct dentry *root = mount_pseudo(fs_type, "aio:", NULL, &ops,
    + AIO_RING_MAGIC);
    +
    + if (!IS_ERR(root))
    + root->d_sb->s_iflags |= SB_I_NOEXEC;
    + return root;
    }

    /* aio_setup

    \
     
     \ /
      Last update: 2016-10-06 11:26    [W:4.058 / U:0.384 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site