1. 31 7月, 2012 2 次提交
    • A
      vsprintf: add %pMR for Bluetooth MAC address · 76597ff9
      Andrei Emeltchenko 提交于
      Bluetooth uses mostly LE byte order which is reversed for visual
      interpretation.  Currently in Bluetooth in use unsafe batostr function.
      
      This is a slightly modified version of Joe's patch (sent Sat, Dec 4,
      2010).
      Signed-off-by: NAndrei Emeltchenko <andrei.emeltchenko@intel.com>
      Cc: Joe Perches <joe@perches.com>
      Cc: Marcel Holtmann <marcel@holtmann.org>
      Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      76597ff9
    • K
      fs: make dumpable=2 require fully qualified path · 9520628e
      Kees Cook 提交于
      When the suid_dumpable sysctl is set to "2", and there is no core dump
      pipe defined in the core_pattern sysctl, a local user can cause core files
      to be written to root-writable directories, potentially with
      user-controlled content.
      
      This means an admin can unknowningly reintroduce a variation of
      CVE-2006-2451, allowing local users to gain root privileges.
      
        $ cat /proc/sys/fs/suid_dumpable
        2
        $ cat /proc/sys/kernel/core_pattern
        core
        $ ulimit -c unlimited
        $ cd /
        $ ls -l core
        ls: cannot access core: No such file or directory
        $ touch core
        touch: cannot touch `core': Permission denied
        $ OHAI="evil-string-here" ping localhost >/dev/null 2>&1 &
        $ pid=$!
        $ sleep 1
        $ kill -SEGV $pid
        $ ls -l core
        -rw------- 1 root kees 458752 Jun 21 11:35 core
        $ sudo strings core | grep evil
        OHAI=evil-string-here
      
      While cron has been fixed to abort reading a file when there is any
      parse error, there are still other sensitive directories that will read
      any file present and skip unparsable lines.
      
      Instead of introducing a suid_dumpable=3 mode and breaking all users of
      mode 2, this only disables the unsafe portion of mode 2 (writing to disk
      via relative path).  Most users of mode 2 (e.g.  Chrome OS) already use
      a core dump pipe handler, so this change will not break them.  For the
      situations where a pipe handler is not defined but mode 2 is still
      active, crash dumps will only be written to fully qualified paths.  If a
      relative path is defined (e.g.  the default "core" pattern), dump
      attempts will trigger a printk yelling about the lack of a fully
      qualified path.
      Signed-off-by: NKees Cook <keescook@chromium.org>
      Cc: Alexander Viro <viro@zeniv.linux.org.uk>
      Cc: Alan Cox <alan@linux.intel.com>
      Cc: "Eric W. Biederman" <ebiederm@xmission.com>
      Cc: Doug Ledford <dledford@redhat.com>
      Cc: Serge Hallyn <serge.hallyn@canonical.com>
      Cc: James Morris <james.l.morris@oracle.com>
      Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      9520628e
  2. 27 7月, 2012 1 次提交
  3. 25 7月, 2012 4 次提交
  4. 24 7月, 2012 9 次提交
  5. 23 7月, 2012 4 次提交
  6. 22 7月, 2012 3 次提交
  7. 21 7月, 2012 4 次提交
  8. 20 7月, 2012 8 次提交
  9. 19 7月, 2012 2 次提交
  10. 18 7月, 2012 3 次提交