lkml.org 
[lkml]   [2021]   [May]   [31]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.4 039/177] serial: core: fix suspicious security_locked_down() call
    Date
    From: Ondrej Mosnacek <omosnace@redhat.com>

    commit 5e722b217ad3cf41f5504db80a68062df82b5242 upstream.

    The commit that added this check did so in a very strange way - first
    security_locked_down() is called, its value stored into retval, and if
    it's nonzero, then an additional check is made for (change_irq ||
    change_port), and if this is true, the function returns. However, if
    the goto exit branch is not taken, the code keeps the retval value and
    continues executing the function. Then, depending on whether
    uport->ops->verify_port is set, the retval value may or may not be reset
    to zero and eventually the error value from security_locked_down() may
    abort the function a few lines below.

    I will go out on a limb and assume that this isn't the intended behavior
    and that an error value from security_locked_down() was supposed to
    abort the function only in case (change_irq || change_port) is true.

    Note that security_locked_down() should be called last in any series of
    checks, since the SELinux implementation of this hook will do a check
    against the policy and generate an audit record in case of denial. If
    the operation was to carry on after calling security_locked_down(), then
    the SELinux denial record would be bogus.

    See commit 59438b46471a ("security,lockdown,selinux: implement SELinux
    lockdown") for how SELinux implements this hook.

    Fixes: 794edf30ee6c ("lockdown: Lock down TIOCSSERIAL")
    Acked-by: Kees Cook <keescook@chromium.org>
    Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
    Cc: stable <stable@vger.kernel.org>
    Link: https://lore.kernel.org/r/20210507115719.140799-1-omosnace@redhat.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    drivers/tty/serial/serial_core.c | 8 +++++---
    1 file changed, 5 insertions(+), 3 deletions(-)

    --- a/drivers/tty/serial/serial_core.c
    +++ b/drivers/tty/serial/serial_core.c
    @@ -863,9 +863,11 @@ static int uart_set_info(struct tty_stru
    goto check_and_exit;
    }

    - retval = security_locked_down(LOCKDOWN_TIOCSSERIAL);
    - if (retval && (change_irq || change_port))
    - goto exit;
    + if (change_irq || change_port) {
    + retval = security_locked_down(LOCKDOWN_TIOCSSERIAL);
    + if (retval)
    + goto exit;
    + }

    /*
    * Ask the low level driver to verify the settings.

    \
     
     \ /
      Last update: 2021-05-31 17:19    [W:3.083 / U:0.760 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site