1. 13 4月, 2016 1 次提交
  2. 23 3月, 2016 1 次提交
    • J
      fs/coredump: prevent fsuid=0 dumps into user-controlled directories · 378c6520
      Jann Horn 提交于
      This commit fixes the following security hole affecting systems where
      all of the following conditions are fulfilled:
      
       - The fs.suid_dumpable sysctl is set to 2.
       - The kernel.core_pattern sysctl's value starts with "/". (Systems
         where kernel.core_pattern starts with "|/" are not affected.)
       - Unprivileged user namespace creation is permitted. (This is
         true on Linux >=3.8, but some distributions disallow it by
         default using a distro patch.)
      
      Under these conditions, if a program executes under secure exec rules,
      causing it to run with the SUID_DUMP_ROOT flag, then unshares its user
      namespace, changes its root directory and crashes, the coredump will be
      written using fsuid=0 and a path derived from kernel.core_pattern - but
      this path is interpreted relative to the root directory of the process,
      allowing the attacker to control where a coredump will be written with
      root privileges.
      
      To fix the security issue, always interpret core_pattern for dumps that
      are written under SUID_DUMP_ROOT relative to the root directory of init.
      Signed-off-by: NJann Horn <jann@thejh.net>
      Acked-by: NKees Cook <keescook@chromium.org>
      Cc: Al Viro <viro@zeniv.linux.org.uk>
      Cc: "Eric W. Biederman" <ebiederm@xmission.com>
      Cc: Andy Lutomirski <luto@kernel.org>
      Cc: Oleg Nesterov <oleg@redhat.com>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      378c6520
  3. 18 3月, 2016 1 次提交
  4. 06 3月, 2016 2 次提交
  5. 19 2月, 2016 1 次提交
  6. 06 2月, 2016 1 次提交
    • N
      um: asm/page.h: remove the pte_high member from struct pte_t · 012a4163
      Nicolai Stange 提交于
      Commit 16da3068 ("um: kill pfn_t") introduced a compile warning for
      defconfig (SUBARCH=i386):
      
        arch/um/kernel/skas/mmu.c:38:206:
            warning: right shift count >= width of type [-Wshift-count-overflow]
      
      Aforementioned patch changes the definition of the phys_to_pfn() macro
      from
      
        ((pfn_t) ((p) >> PAGE_SHIFT))
      
      to
      
        ((p) >> PAGE_SHIFT)
      
      This effectively changes the phys_to_pfn() expansion's type from
      unsigned long long to unsigned long.
      
      Through the callchain init_stub_pte() => mk_pte(), the expansion of
      phys_to_pfn() is (indirectly) fed into the 'phys' argument of the
      pte_set_val(pte, phys, prot) macro, eventually leading to
      
        (pte).pte_high = (phys) >> 32;
      
      This results in the warning from above.
      
      Since UML only deals with 32 bit addresses, the upper 32 bits from
      'phys' used to be always zero anyway.  Also, all page protection flags
      defined by UML don't use any bits beyond bit 9.  Since the contents of a
      PTE are defined within architecture scope only, the ->pte_high member
      can be safely removed.
      
      Remove the ->pte_high member from struct pte_t.
      Rename ->pte_low to ->pte.
      Adapt the pte helper macros in arch/um/include/asm/page.h.
      
      Noteworthy is the pte_copy() macro where a smp_wmb() gets dropped.  This
      write barrier doesn't seem to be paired with any read barrier though and
      thus, was useless anyway.
      
      Fixes: 16da3068 ("um: kill pfn_t")
      Signed-off-by: NNicolai Stange <nicstange@gmail.com>
      Cc: Dan Williams <dan.j.williams@intel.com>
      Cc: Richard Weinberger <richard@nod.at>
      Cc: Nicolai Stange <nicstange@gmail.com>
      Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      012a4163
  7. 16 1月, 2016 1 次提交
  8. 11 1月, 2016 9 次提交
    • M
      um: Use race-free temporary file creation · 3e46b253
      Mickaël Salaün 提交于
      Open the memory mapped file with the O_TMPFILE flag when available.
      Signed-off-by: NMickaël Salaün <mic@digikod.net>
      Cc: Jeff Dike <jdike@addtoit.com>
      Cc: Richard Weinberger <richard@nod.at>
      Acked-by: NTristan Schmelcher <tschmelcher@google.com>
      Signed-off-by: NRichard Weinberger <richard@nod.at>
      3e46b253
    • M
      um: Do not set unsecure permission for temporary file · 571d2f0c
      Mickaël Salaün 提交于
      Remove the insecure 0777 mode for temporary file to prohibit other users
      to change the executable mapped code.
      
      An attacker could gain access to the mapped file descriptor from the
      temporary file (before it is unlinked) in a read-only mode but it should
      not be accessible in write mode to avoid arbitrary code execution.
      
      To not change the hostfs behavior, the temporary file creation
      permission now depends on the current umask(2) and the implementation of
      mkstemp(3).
      Signed-off-by: NMickaël Salaün <mic@digikod.net>
      Cc: Jeff Dike <jdike@addtoit.com>
      Cc: Richard Weinberger <richard@nod.at>
      Acked-by: NTristan Schmelcher <tschmelcher@google.com>
      Signed-off-by: NRichard Weinberger <richard@nod.at>
      571d2f0c
    • M
      um: Add seccomp support · c50b4659
      Mickaël Salaün 提交于
      This brings SECCOMP_MODE_STRICT and SECCOMP_MODE_FILTER support through
      prctl(2) and seccomp(2) to User-mode Linux for i386 and x86_64
      subarchitectures.
      
      secure_computing() is called first in handle_syscall() so that the
      syscall emulation will be aborted quickly if matching a seccomp rule.
      
      This is inspired from Meredydd Luff's patch
      (https://gerrit.chromium.org/gerrit/21425).
      Signed-off-by: NMickaël Salaün <mic@digikod.net>
      Cc: Jeff Dike <jdike@addtoit.com>
      Cc: Richard Weinberger <richard@nod.at>
      Cc: Ingo Molnar <mingo@redhat.com>
      Cc: Kees Cook <keescook@chromium.org>
      Cc: Andy Lutomirski <luto@amacapital.net>
      Cc: Will Drewry <wad@chromium.org>
      Cc: Chris Metcalf <cmetcalf@ezchip.com>
      Cc: Michael Ellerman <mpe@ellerman.id.au>
      Cc: James Hogan <james.hogan@imgtec.com>
      Cc: Meredydd Luff <meredydd@senatehouse.org>
      Cc: David Drysdale <drysdale@google.com>
      Signed-off-by: NRichard Weinberger <richard@nod.at>
      Acked-by: NKees Cook <keescook@chromium.org>
      c50b4659
    • M
      um: Add full asm/syscall.h support · d8f8b844
      Mickaël Salaün 提交于
      Add subarchitecture-independent implementation of asm-generic/syscall.h
      allowing access to user system call parameters and results:
      * syscall_get_nr()
      * syscall_rollback()
      * syscall_get_error()
      * syscall_get_return_value()
      * syscall_set_return_value()
      * syscall_get_arguments()
      * syscall_set_arguments()
      * syscall_get_arch() provided by arch/x86/um/asm/syscall.h
      
      This provides the necessary syscall helpers needed by
      HAVE_ARCH_SECCOMP_FILTER plus syscall_get_error().
      
      This is inspired from Meredydd Luff's patch
      (https://gerrit.chromium.org/gerrit/21425).
      Signed-off-by: NMickaël Salaün <mic@digikod.net>
      Cc: Jeff Dike <jdike@addtoit.com>
      Cc: Richard Weinberger <richard@nod.at>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Cc: Ingo Molnar <mingo@redhat.com>
      Cc: H. Peter Anvin <hpa@zytor.com>
      Cc: Kees Cook <keescook@chromium.org>
      Cc: Andy Lutomirski <luto@amacapital.net>
      Cc: Will Drewry <wad@chromium.org>
      Cc: Meredydd Luff <meredydd@senatehouse.org>
      Cc: David Drysdale <drysdale@google.com>
      Signed-off-by: NRichard Weinberger <richard@nod.at>
      Acked-by: NKees Cook <keescook@chromium.org>
      d8f8b844
    • M
      um: Fix ptrace GETREGS/SETREGS bugs · e04c989e
      Mickaël Salaün 提交于
      This fix two related bugs:
      * PTRACE_GETREGS doesn't get the right orig_ax (syscall) value
      * PTRACE_SETREGS can't set the orig_ax value (erased by initial value)
      
      Get rid of the now useless and error-prone get_syscall().
      
      Fix inconsistent behavior in the ptrace implementation for i386 when
      updating orig_eax automatically update the syscall number as well. This
      is now updated in handle_syscall().
      Signed-off-by: NMickaël Salaün <mic@digikod.net>
      Cc: Jeff Dike <jdike@addtoit.com>
      Cc: Richard Weinberger <richard@nod.at>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Cc: Kees Cook <keescook@chromium.org>
      Cc: Andy Lutomirski <luto@amacapital.net>
      Cc: Will Drewry <wad@chromium.org>
      Cc: Thomas Meyer <thomas@m3y3r.de>
      Cc: Nicolas Iooss <nicolas.iooss_linux@m4x.org>
      Cc: Anton Ivanov <aivanov@brocade.com>
      Cc: Meredydd Luff <meredydd@senatehouse.org>
      Cc: David Drysdale <drysdale@google.com>
      Signed-off-by: NRichard Weinberger <richard@nod.at>
      Acked-by: NKees Cook <keescook@chromium.org>
      e04c989e
    • A
      um: Update UBD to use pread/pwrite family of functions · 8c6157b6
      Anton Ivanov 提交于
      This decreases the number of syscalls per read/write by half.
      Signed-off-by: NAnton Ivanov <aivanov@brocade.com>
      Signed-off-by: NRichard Weinberger <richard@nod.at>
      8c6157b6
    • A
      um: Do not change hard IRQ flags in soft IRQ processing · 470a166e
      Anton Ivanov 提交于
      Software IRQ processing in generic architectures assumes that the
      exit out of hard IRQ may have re-enabled interrupts (some
      architectures may have an implicit EOI). It presumes them enabled
      and toggles the flags once more just in case unless this is turned
      off in the architecture specific hardirq.h by setting
      __ARCH_IRQ_EXIT_IRQS_DISABLED
      
      This patch adds this to UML where due to the way IRQs are handled
      it is an optimization (it works fine without it too).
      Signed-off-by: NAnton Ivanov <aivanov@brocade.com>
      Signed-off-by: NRichard Weinberger <richard@nod.at>
      470a166e
    • A
      um: Prevent IRQ handler reentrancy · d5e3f5cb
      Anton Ivanov 提交于
      The existing IRQ handler design in UML does not prevent reentrancy
      
      This is mitigated by fd-enable/fd-disable semantics for the IO
      portion of the UML subsystem. The timer, however, can and is
      re-entered resulting in very deep stack usage and occasional
      stack exhaustion.
      
      This patch prevents this by checking if there is a timer
      interrupt in-flight before processing any pending timer interrupts.
      Signed-off-by: NAnton Ivanov <aivanov@brocade.com>
      Signed-off-by: NRichard Weinberger <richard@nod.at>
      d5e3f5cb
    • V
      uml: flush stdout before forking · 0754fb29
      Vegard Nossum 提交于
      I was seeing some really weird behaviour where piping UML's output
      somewhere would cause output to get duplicated:
      
        $ ./vmlinux | head -n 40
        Checking that ptrace can change system call numbers...Core dump limits :
                soft - 0
                hard - NONE
        OK
        Checking syscall emulation patch for ptrace...Core dump limits :
                soft - 0
                hard - NONE
        OK
        Checking advanced syscall emulation patch for ptrace...Core dump limits :
                soft - 0
                hard - NONE
        OK
        Core dump limits :
                soft - 0
                hard - NONE
      
      This is because these tests do a fork() which duplicates the non-empty
      stdout buffer, then glibc flushes the duplicated buffer as each child
      exits.
      
      A simple workaround is to flush before forking.
      
      Cc: stable@vger.kernel.org
      Signed-off-by: NVegard Nossum <vegard.nossum@oracle.com>
      Signed-off-by: NRichard Weinberger <richard@nod.at>
      0754fb29
  9. 04 1月, 2016 2 次提交
  10. 09 12月, 2015 3 次提交
    • G
      um: fix returns without va_end · 887a9853
      Geyslan G. Bem 提交于
      When using va_list ensure that va_start will be followed by va_end.
      Signed-off-by: NGeyslan G. Bem <geyslan@gmail.com>
      Signed-off-by: NRichard Weinberger <richard@nod.at>
      887a9853
    • L
      arch: um: fix error when linking vmlinux. · fb1770aa
      Lorenzo Colitti 提交于
      On gcc Ubuntu 4.8.4-2ubuntu1~14.04, linking vmlinux fails with:
      
      arch/um/os-Linux/built-in.o: In function `os_timer_create':
      /android/kernel/android/arch/um/os-Linux/time.c:51: undefined reference to `timer_create'
      arch/um/os-Linux/built-in.o: In function `os_timer_set_interval':
      /android/kernel/android/arch/um/os-Linux/time.c:84: undefined reference to `timer_settime'
      arch/um/os-Linux/built-in.o: In function `os_timer_remain':
      /android/kernel/android/arch/um/os-Linux/time.c:109: undefined reference to `timer_gettime'
      arch/um/os-Linux/built-in.o: In function `os_timer_one_shot':
      /android/kernel/android/arch/um/os-Linux/time.c:132: undefined reference to `timer_settime'
      arch/um/os-Linux/built-in.o: In function `os_timer_disable':
      /android/kernel/android/arch/um/os-Linux/time.c:145: undefined reference to `timer_settime'
      
      This is because -lrt appears in the generated link commandline
      after arch/um/os-Linux/built-in.o. Fix this by removing -lrt from
      arch/um/Makefile and adding it to the UM-specific section of
      scripts/link-vmlinux.sh.
      Signed-off-by: NLorenzo Colitti <lorenzo@google.com>
      Signed-off-by: NRichard Weinberger <richard@nod.at>
      fb1770aa
    • R
      um: Fix get_signal() usage · db2f24dc
      Richard Weinberger 提交于
      If get_signal() returns us a signal to post
      we must not call it again, otherwise the already
      posted signal will be overridden.
      Before commit a610d6e6 this was the case as we stopped
      the while after a successful handle_signal().
      
      Cc: <stable@vger.kernel.org> # 3.10-
      Fixes: a610d6e6 ("pull clearing RESTORE_SIGMASK into block_sigmask()")
      Signed-off-by: NRichard Weinberger <richard@nod.at>
      db2f24dc
  11. 07 11月, 2015 6 次提交
  12. 20 10月, 2015 3 次提交
  13. 10 8月, 2015 1 次提交
  14. 18 7月, 2015 1 次提交
  15. 09 7月, 2015 1 次提交
    • C
      Make asm/word-at-a-time.h available on all architectures · a6e2f029
      Chris Metcalf 提交于
      Added the x86 implementation of word-at-a-time to the
      generic version, which previously only supported big-endian.
      
      Omitted the x86-specific load_unaligned_zeropad(), which in
      any case is also not present for the existing BE-only
      implementation of a word-at-a-time, and is only used under
      CONFIG_DCACHE_WORD_ACCESS.
      
      Added as a "generic-y" to the Kbuilds of all architectures
      that didn't previously have it.
      Signed-off-by: NChris Metcalf <cmetcalf@ezchip.com>
      a6e2f029
  16. 07 7月, 2015 1 次提交
    • I
      um: Fix do_signal() prototype · ccaee5f8
      Ingo Molnar 提交于
      Once x86 exports its do_signal(), the prototypes will clash.
      
      Fix the clash and also improve the code a bit: remove the
      unnecessary kern_do_signal() indirection. This allows
      interrupt_end() to share the 'regs' parameter calculation.
      
      Also remove the unused return code to match x86.
      
      Minimally build and boot tested.
      Signed-off-by: NIngo Molnar <mingo@kernel.org>
      Signed-off-by: NAndy Lutomirski <luto@kernel.org>
      Cc: Andrew Morton <akpm@linux-foundation.org>
      Cc: Andy Lutomirski <luto@amacapital.net>
      Cc: Borislav Petkov <bp@alien8.de>
      Cc: Brian Gerst <brgerst@gmail.com>
      Cc: Denys Vlasenko <dvlasenk@redhat.com>
      Cc: Denys Vlasenko <vda.linux@googlemail.com>
      Cc: Frederic Weisbecker <fweisbec@gmail.com>
      Cc: H. Peter Anvin <hpa@zytor.com>
      Cc: Kees Cook <keescook@chromium.org>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Oleg Nesterov <oleg@redhat.com>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Richard Weinberger <richard.weinberger@gmail.com>
      Cc: Rik van Riel <riel@redhat.com>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Cc: paulmck@linux.vnet.ibm.com
      Link: http://lkml.kernel.org/r/67c57eac09a589bac3c6c5ff22f9623ec55a184a.1435952415.git.luto@kernel.orgSigned-off-by: NIngo Molnar <mingo@kernel.org>
      ccaee5f8
  17. 26 6月, 2015 4 次提交
  18. 25 6月, 2015 1 次提交
    • L
      mm: new mm hook framework · 2ae416b1
      Laurent Dufour 提交于
      CRIU is recreating the process memory layout by remapping the checkpointee
      memory area on top of the current process (criu).  This includes remapping
      the vDSO to the place it has at checkpoint time.
      
      However some architectures like powerpc are keeping a reference to the
      vDSO base address to build the signal return stack frame by calling the
      vDSO sigreturn service.  So once the vDSO has been moved, this reference
      is no more valid and the signal frame built later are not usable.
      
      This patch serie is introducing a new mm hook framework, and a new
      arch_remap hook which is called when mremap is done and the mm lock still
      hold.  The next patch is adding the vDSO remap and unmap tracking to the
      powerpc architecture.
      
      This patch (of 3):
      
      This patch introduces a new set of header file to manage mm hooks:
      - per architecture empty header file (arch/x/include/asm/mm-arch-hooks.h)
      - a generic header (include/linux/mm-arch-hooks.h)
      
      The architecture which need to overwrite a hook as to redefine it in its
      header file, while architecture which doesn't need have nothing to do.
      
      The default hooks are defined in the generic header and are used in the
      case the architecture is not defining it.
      
      In a next step, mm hooks defined in include/asm-generic/mm_hooks.h should
      be moved here.
      Signed-off-by: NLaurent Dufour <ldufour@linux.vnet.ibm.com>
      Suggested-by: NAndrew Morton <akpm@linux-foundation.org>
      Cc: "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com>
      Cc: Hugh Dickins <hughd@google.com>
      Cc: Rik van Riel <riel@redhat.com>
      Cc: Mel Gorman <mgorman@suse.de>
      Cc: Pavel Emelyanov <xemul@parallels.com>
      Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
      Cc: Paul Mackerras <paulus@samba.org>
      Cc: Michael Ellerman <mpe@ellerman.id.au>
      Cc: Ingo Molnar <mingo@kernel.org>
      Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      2ae416b1