Messages in this thread | | | Date | Mon, 1 Apr 2019 15:04:01 +0200 | From | Torsten Duwe <> | Subject | Re: [PATCH] fs/open: Fix most outstanding security bugs |
| |
On Mon, Apr 01, 2019 at 11:01:13AM +0200, Johannes Thumshirn wrote: > Over the last 20 years, the Linux kernel has accumulated hundreds if not > thousands of security vulnerabilities. > > One common pattern in most of these security related reports is processes > called "syzkaller", "trinity" or "syz-executor" opening files and then > abuse kernel interfaces causing kernel crashes or even worse threats using > memory overwrites or by exploiting race conditions. > > Hunting down these bugs has become time consuming and very expensive, so > I've decided to put an end to it. > > If one of the above mentioned processes tries opening a file, return -EPERM > indicating this process does not have the permission to open files on Linux > anymore. > > Signed-off-by: Johannes Thumshirn <jthumshirn@suse.de> > --- > fs/open.c | 14 ++++++++++++++ > 1 file changed, 14 insertions(+) > > diff --git a/fs/open.c b/fs/open.c > index f1c2f855fd43..3a3b460beccd 100644 > --- a/fs/open.c > +++ b/fs/open.c > @@ -1056,6 +1056,20 @@ long do_sys_open(int dfd, const char __user *filename, int flags, umode_t mode) > struct open_flags op; > int fd = build_open_flags(flags, mode, &op); > struct filename *tmp; > + char comm[TASK_COMM_LEN]; > + int i; > + static const char * const list[] = {
"list" is a bit ambiguous. You could call it "blacklist" or such.
> + "syzkaller", > + "syz-executor," > + "trinity", > + NULL > + }; > + > + get_task_comm(comm, current); > + > + for (i = 0; i < ARRAY_SIZE(list); i++) > + if (!strncmp(comm, list[i], strlen(list[i]))) > + return -EPERM; ^^^^^^^ should be -ECONNRESET.
Also, I'm missing a sysfs parameter file to add more bad guys dynamically.
> if (fd) > return fd; > -- > 2.16.4
But for a start, this is OK. In any case, as already mentioned, big player Cisco has shown us that this is definitely the way to go!
Rviewed-by: Torsten Duwe <duwe@lst.de>
| |