diff options
author | Nick Desaulniers <ndesaulniers@google.com> | 2016-11-18 10:44:16 -0800 |
---|---|---|
committer | Andreas Blaesius <skate4life@gmx.de> | 2017-05-17 19:25:36 +0200 |
commit | f4d9d78deb47216e846fa9afe01c1c72ecf09ae2 (patch) | |
tree | 22b3f69f91e2e9671528954602e98cae2aa09c8f | |
parent | ff8408e89b2538dc416a431e656a48f73dafcfeb (diff) | |
download | kernel_samsung_tuna-f4d9d78deb47216e846fa9afe01c1c72ecf09ae2.tar.gz kernel_samsung_tuna-f4d9d78deb47216e846fa9afe01c1c72ecf09ae2.tar.bz2 kernel_samsung_tuna-f4d9d78deb47216e846fa9afe01c1c72ecf09ae2.zip |
BACKPORT: aio: mark AIO pseudo-fs noexec
This ensures that do_mmap() won't implicitly make AIO memory mappings
executable if the READ_IMPLIES_EXEC personality flag is set. Such
behavior is problematic because the security_mmap_file LSM hook doesn't
catch this case, potentially permitting an attacker to bypass a W^X
policy enforced by SELinux.
I have tested the patch on my machine.
To test the behavior, compile and run this:
#define _GNU_SOURCE
#include <unistd.h>
#include <sys/personality.h>
#include <linux/aio_abi.h>
#include <err.h>
#include <stdlib.h>
#include <stdio.h>
#include <sys/syscall.h>
int main(void) {
personality(READ_IMPLIES_EXEC);
aio_context_t ctx = 0;
if (syscall(__NR_io_setup, 1, &ctx))
err(1, "io_setup");
char cmd[1000];
sprintf(cmd, "cat /proc/%d/maps | grep -F '/[aio]'",
(int)getpid());
system(cmd);
return 0;
}
In the output, "rw-s" is good, "rwxs" is bad.
Signed-off-by: Jann Horn <jann@thejh.net>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
(cherry picked from commit 22f6b4d34fcf039c63a94e7670e0da24f8575a5a)
Bug: 31711619
Change-Id: I9f2872703bef240d6b82320c744529459bb076dc
-rw-r--r-- | fs/aio.c | 4 |
1 files changed, 4 insertions, 0 deletions
@@ -35,6 +35,7 @@ #include <linux/eventfd.h> #include <linux/blkdev.h> #include <linux/compat.h> +#include <linux/personality.h> #include <asm/kmap_types.h> #include <asm/uaccess.h> @@ -112,6 +113,9 @@ static int aio_setup_ring(struct kioctx *ctx) unsigned long size; int nr_pages; + if (current->personality & READ_IMPLIES_EXEC) + return -EPERM; + /* Compensate for the ring buffer's head/tail overlap entry */ nr_events += 2; /* 1 is required, 2 for good luck */ |