lkml.org 
[lkml]   [2020]   [Jan]   [2]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.14 54/91] userfaultfd: require CAP_SYS_PTRACE for UFFD_FEATURE_EVENT_FORK
    Date
    From: Mike Rapoport <rppt@linux.ibm.com>

    [ Upstream commit 3c1c24d91ffd536de0a64688a9df7f49e58fadbc ]

    A while ago Andy noticed
    (http://lkml.kernel.org/r/CALCETrWY+5ynDct7eU_nDUqx=okQvjm=Y5wJvA4ahBja=CQXGw@mail.gmail.com)
    that UFFD_FEATURE_EVENT_FORK used by an unprivileged user may have
    security implications.

    As the first step of the solution the following patch limits the availably
    of UFFD_FEATURE_EVENT_FORK only for those having CAP_SYS_PTRACE.

    The usage of CAP_SYS_PTRACE ensures compatibility with CRIU.

    Yet, if there are other users of non-cooperative userfaultfd that run
    without CAP_SYS_PTRACE, they would be broken :(

    Current implementation of UFFD_FEATURE_EVENT_FORK modifies the file
    descriptor table from the read() implementation of uffd, which may have
    security implications for unprivileged use of the userfaultfd.

    Limit availability of UFFD_FEATURE_EVENT_FORK only for callers that have
    CAP_SYS_PTRACE.

    Link: http://lkml.kernel.org/r/1572967777-8812-2-git-send-email-rppt@linux.ibm.com
    Signed-off-by: Mike Rapoport <rppt@linux.ibm.com>
    Reviewed-by: Andrea Arcangeli <aarcange@redhat.com>
    Cc: Daniel Colascione <dancol@google.com>
    Cc: Jann Horn <jannh@google.com>
    Cc: Lokesh Gidra <lokeshgidra@google.com>
    Cc: Nick Kralevich <nnk@google.com>
    Cc: Nosh Minwalla <nosh@google.com>
    Cc: Pavel Emelyanov <ovzxemul@gmail.com>
    Cc: Tim Murray <timmurray@google.com>
    Cc: Aleksa Sarai <cyphar@cyphar.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    fs/userfaultfd.c | 18 +++++++++++-------
    1 file changed, 11 insertions(+), 7 deletions(-)

    diff --git a/fs/userfaultfd.c b/fs/userfaultfd.c
    index a609d480606d..e2b2196fd942 100644
    --- a/fs/userfaultfd.c
    +++ b/fs/userfaultfd.c
    @@ -1807,13 +1807,12 @@ static int userfaultfd_api(struct userfaultfd_ctx *ctx,
    if (copy_from_user(&uffdio_api, buf, sizeof(uffdio_api)))
    goto out;
    features = uffdio_api.features;
    - if (uffdio_api.api != UFFD_API || (features & ~UFFD_API_FEATURES)) {
    - memset(&uffdio_api, 0, sizeof(uffdio_api));
    - if (copy_to_user(buf, &uffdio_api, sizeof(uffdio_api)))
    - goto out;
    - ret = -EINVAL;
    - goto out;
    - }
    + ret = -EINVAL;
    + if (uffdio_api.api != UFFD_API || (features & ~UFFD_API_FEATURES))
    + goto err_out;
    + ret = -EPERM;
    + if ((features & UFFD_FEATURE_EVENT_FORK) && !capable(CAP_SYS_PTRACE))
    + goto err_out;
    /* report all available features and ioctls to userland */
    uffdio_api.features = UFFD_API_FEATURES;
    uffdio_api.ioctls = UFFD_API_IOCTLS;
    @@ -1826,6 +1825,11 @@ static int userfaultfd_api(struct userfaultfd_ctx *ctx,
    ret = 0;
    out:
    return ret;
    +err_out:
    + memset(&uffdio_api, 0, sizeof(uffdio_api));
    + if (copy_to_user(buf, &uffdio_api, sizeof(uffdio_api)))
    + ret = -EFAULT;
    + goto out;
    }

    static long userfaultfd_ioctl(struct file *file, unsigned cmd,
    --
    2.20.1


    \
     
     \ /
      Last update: 2020-01-02 23:50    [W:5.419 / U:0.124 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site