Salvatore Mesoraca
0c41beebcd
namei: allow restricted O_CREAT of FIFOs and regular files ...
commit 30aba6656f61ed44cba445a3c0d38b296fa9e8f5 upstream.
Disallows open of FIFOs or regular files not owned by the user in world
writable sticky directories, unless the owner is the same as that of the
directory or the file is opened without the O_CREAT flag. The purpose
is to make data spoofing attacks harder. This protection can be turned
on and off separately for FIFOs and regular files via sysctl, just like
the symlinks/hardlinks protection. This patch is based on Openwall's
"HARDEN_FIFO" feature by Solar Designer.
This is a brief list of old vulnerabilities that could have been prevented
by this feature, some of them even allow for privilege escalation:
CVE-2000-1134
CVE-2007-3852
CVE-2008-0525
CVE-2009-0416
CVE-2011-4834
CVE-2015-1838
CVE-2015-7442
CVE-2016-7489
This list is not meant to be complete. It's difficult to track down all
vulnerabilities of this kind because they were often reported without any
mention of this particular attack vector. In fact, before
hardlinks/symlinks restrictions, fifos/regular files weren't the favorite
vehicle to exploit them.
[s.mesoraca16@gmail.com: fix bug reported by Dan Carpenter]
Link: https://lkml.kernel.org/r/20180426081456.GA7060@mwanda
Link: http://lkml.kernel.org/r/1524829819-11275-1-git-send-email-s.mesoraca16@gmail.com
[keescook@chromium.org: drop pr_warn_ratelimited() in favor of audit changes in the future]
[keescook@chromium.org: adjust commit subjet]
Link: http://lkml.kernel.org/r/20180416175918.GA13494@beast
Signed-off-by: Salvatore Mesoraca <s.mesoraca16@gmail.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Suggested-by: Solar Designer <solar@openwall.com>
Suggested-by: Kees Cook <keescook@chromium.org>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Loic <hackurx@opensec.fr>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-12-01 09:44:25 +01:00
v9fs_dir_readdir: fix double-free on p9stat_read error
2018-12-01 09:44:18 +01:00
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2016-10-10 20:16:43 -07:00
affs_lookup(): close a race with affs_remove_link()
2018-05-30 07:50:16 +02:00
afs: Fix abort on signal while waiting for call completion
2017-12-20 10:07:25 +01:00
autofs: fix autofs_sbi() does not check super block type
2018-09-19 22:47:16 +02:00
befs fixes for 4.9-rc1
2016-10-15 12:09:13 -07:00
bfs: add sanity check at bfs_fill_super()
2018-12-01 09:44:19 +01:00
btrfs: fix pinned underflow after transaction aborted
2018-11-27 16:09:40 +01:00
cachefiles: fix the race between cachefiles_bury_object() and rmdir(2)
2018-11-10 07:43:00 -08:00
Revert "ceph: fix dentry leak in splice_dentry()"
2018-11-21 09:25:59 +01:00
cifs: don't dereference smb_file_target before null check
2018-11-27 16:09:37 +01:00
coda: fix 'kernel memory exposure attempt' in fsync
2017-11-24 08:33:42 +01:00
configfs: replace strncpy with memcpy
2018-11-21 09:26:03 +01:00
Cramfs: fix abad comparison when wrap-arounds occur
2018-11-13 11:17:03 -08:00
fscrypt: use unbound workqueue for decryption
2018-08-03 07:55:20 +02:00
dentry name snapshots
2017-08-06 18:59:43 -07:00
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2016-10-10 20:16:43 -07:00
dlm: avoid double-free on error path in dlm_device_{register,unregister}
2017-09-09 17:39:40 +02:00
do d_instantiate/unlock_new_inode combinations safely
2018-05-30 07:50:16 +02:00
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2016-10-10 20:16:43 -07:00
fs/exofs: fix potential memory leak in mount option parsing
2018-11-27 16:09:38 +01:00
exportfs: be careful to only return expected errors.
2016-10-06 09:07:44 -04:00
do d_instantiate/unlock_new_inode combinations safely
2018-05-30 07:50:16 +02:00
ext4: fix buffer leak in __ext4_read_dirblock() on error path
2018-11-21 09:26:02 +01:00
f2fs: fix multiple f2fs_add_link() having same name for inline dentry
2018-11-10 07:42:45 -08:00
fs/fat/fatent.c: add cond_resched() to fat_count_free_clusters()
2018-11-10 07:42:56 -08:00
fscache: Allow cancelled operations to be enqueued
2018-09-05 09:20:02 +02:00
fuse: fix leaked notify reply
2018-11-21 09:26:03 +01:00
gfs2: Don't leave s_fs_info pointing to freed memory in init_sbd
2018-12-01 09:44:19 +01:00
hfs: prevent btree data loss on root split
2018-11-27 16:09:38 +01:00
hfsplus: prevent btree data loss on root split
2018-11-27 16:09:38 +01:00
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2016-10-10 20:16:43 -07:00
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2016-10-10 20:16:43 -07:00
hugetlbfs: initialize shared policy as part of inode allocation
2017-10-08 10:26:09 +02:00
isofs: fix timestamps beyond 2027
2017-11-30 08:39:04 +00:00
jbd2: fix use after free in jbd2_log_do_checkpoint()
2018-11-13 11:16:55 -08:00
jffs2: free jffs2_sb_info through jffs2_kill_sb()
2018-11-13 11:16:46 -08:00
jfs: Fix inconsistency between memory allocation and ea_buf->max_size
2018-08-09 12:18:00 +02:00
kernfs: fix regression in kernfs_fop_write caused by wrong type
2018-02-17 13:21:15 +01:00
lockd: fix access beyond unterminated strings in prints
2018-11-13 11:17:02 -08:00
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2016-10-10 20:16:43 -07:00
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2016-10-10 20:16:43 -07:00
staging: ncpfs: memory corruption in ncp_read_kernel()
2018-03-28 18:39:23 +02:00
NFSv4.1: Fix the r/wsize checking
2018-11-13 11:17:01 -08:00
lockd: fix "list_add double add" caused by legacy signal interface
2018-02-03 17:05:38 +01:00
nfsd: COPY and CLONE operations require the saved filehandle to be set
2018-11-21 09:26:03 +01:00
do d_instantiate/unlock_new_inode combinations safely
2018-05-30 07:50:16 +02:00
fanotify: fix logic of events on child
2018-04-24 09:34:18 +02:00
fs: remove the never implemented aio_fsync file operation
2016-10-30 13:09:42 -04:00
ocfs2: fix a misuse a of brelse after failing ocfs2_check_dir_entry
2018-11-21 09:26:00 +01:00
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2016-10-10 20:16:43 -07:00
fs: Replace CURRENT_TIME with current_time() for inode timestamps
2016-09-27 21:06:21 -04:00
orangefs: off by ones in xattr size checks
2018-11-10 07:42:46 -08:00
ovl: filter trusted xattr for non-admin
2018-04-13 19:48:12 +02:00
sched/cputime: Convert kcpustat to nsecs
2018-10-20 09:51:32 +02:00
pstore: Fix incorrect persistent ram buffer mapping
2018-09-26 08:36:35 +02:00
fs/quota: Fix spectre gadget in do_quotactl
2018-09-09 20:01:26 +02:00
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2016-10-10 20:16:43 -07:00
reiserfs: propagate errors from fill_with_dentries() properly
2018-11-27 16:09:38 +01:00
romfs: use different way to generate fsid for BLOCK or MTD
2017-06-17 06:41:56 +02:00
Squashfs: Compute expected length from inode size rather than block length
2018-09-05 09:20:03 +02:00
scsi: sysfs: Introduce sysfs_{un,}break_active_protection()
2018-09-05 09:20:10 +02:00
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2016-10-10 20:16:43 -07:00
fs: Replace CURRENT_TIME with current_time() for inode timestamps
2016-09-27 21:06:21 -04:00
ubifs: Check for name being NULL while mounting
2018-10-13 09:18:58 +02:00
udf: Detect incorrect directory size
2018-07-03 11:23:17 +02:00
ufs: we need to sync inode before freeing it
2018-11-10 07:42:49 -08:00
xfs: truncate transaction does not modify the inobt
2018-11-10 07:43:00 -08:00
fix io_destroy()/aio_complete() race
2018-06-06 16:44:38 +02:00
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2016-10-10 20:16:43 -07:00
bad_inode: add missing i_op initializers
2017-01-09 08:32:24 +01:00
binfmt_elf: Respect error return from `regset->active'
2018-09-26 08:36:37 +02:00
fs/binfmt_misc.c: do not allow offset overflow
2018-06-26 08:08:09 +08:00
fs/mpage.c: fix mpage_writepage() for pages with buffers
2017-10-18 09:35:39 +02:00
fs: add i_blocksize()
2017-06-14 15:06:00 +02:00
dax: define a unified inode/address_space for device-dax mappings
2016-08-23 22:58:51 -07:00
compat: remove compat_printk()
2016-09-27 21:20:53 -04:00
binfmt_elf: compat: avoid unused function warning
2018-02-25 11:05:55 +01:00
fs: compat: Remove warning from COMPATIBLE_IOCTL
2018-04-08 12:12:44 +02:00
coredump: Ensure proper size of sparse core files
2017-07-05 14:40:26 +02:00
fs/dax.c: fix inefficiency in dax_writeback_mapping_range()
2018-02-28 10:18:33 +01:00
fs/dcache.c: fix kmemcheck splat at take_dentry_name_snapshot()
2018-09-15 09:42:58 +02:00
direct-io: Prevent NULL pointer access in submit_page_section
2017-10-18 09:35:41 +02:00
epoll: fix race between ep_poll_callback(POLLFREE) and ep_free()/ep_remove()
2017-09-07 08:35:41 +02:00
exec: avoid gcc-8 warning for get_task_comm
2018-07-28 07:49:14 +02:00
fs/fcntl: f_setown, avoid undefined behaviour
2018-01-31 12:55:52 +01:00
fs/file: more unsigned file descriptors
2016-09-27 18:47:38 -04:00
bdi: Fix oops in wb_workfn()
2018-05-16 10:08:42 +02:00
Fix up non-directory creation in SGID directories
2018-07-17 11:37:53 +02:00
xfs: evict all inodes involved with log redo item
2017-09-20 08:20:01 +02:00
vfs: cap dedupe request structure size at PAGE_SIZE
2016-09-15 13:29:52 -07:00
iomap: fix integer truncation issues in the zeroing and dirtying helpers
2017-09-20 08:19:59 +02:00
mm/hugetlb: introduce ARCH_HAS_GIGANTIC_PAGE
2016-10-07 18:46:29 -07:00
libfs: Modify mount_pseudo_xattr to be clear it is not a userspace mount
2017-12-09 22:01:51 +01:00
locking, fs/locks: Add missing file_sem locks
2016-10-18 12:21:28 +02:00
mbcache: initialize entry->e_referenced in mb_cache_entry_create()
2018-02-22 15:43:48 +01:00
mnt: In propgate_umount handle visiting mounts in any order
2017-07-21 07:42:22 +02:00
fs/mpage.c: fix mpage_writepage() for pages with buffers
2017-10-18 09:35:39 +02:00
namei: allow restricted O_CREAT of FIFOs and regular files
2018-12-01 09:44:25 +01:00
mount: Prevent MNT_DETACH from disconnecting locked mounts
2018-11-21 09:26:02 +01:00
nsfs: mark dentry with DCACHE_RCUACCESS
2018-02-17 13:21:15 +01:00
fs: completely ignore unknown open flags
2017-07-12 15:01:02 +02:00
pipe: fix off-by-one error when checking buffer limits
2018-02-17 13:21:18 +01:00
mnt: Make propagate_umount less slow for overlapping mount propagation trees
2017-07-21 07:42:22 +02:00
mnt: Tuck mounts under others instead of creating shadow/side mounts.
2017-03-15 10:02:43 +08:00
tmpfs: clear S_ISGID when setting posix ACLs
2017-01-26 08:24:37 +01:00
vfs: deny copy_file_range() for non regular files
2017-10-12 11:51:26 +02:00
fs/select: add vmalloc fallback for select(2)
2016-10-11 15:06:30 -07:00
seq/proc: modify seq_put_decimal_[u]ll to take a const char *, not char
2016-10-07 18:46:30 -07:00
vfs: fix uninitialized flags in splice_to_pipe()
2017-02-23 17:44:35 +01:00
ufs: restore maintaining ->i_blocks
2017-06-14 15:06:01 +02:00
sget(): handle failures of register_shrinker()
2018-03-03 10:23:21 +01:00
timerfd: Protect the might cancel mechanism proper
2017-05-08 07:47:54 +02:00
userfaultfd: shmem: __do_fault requires VM_FAULT_NOPAGE
2017-12-20 10:07:18 +01:00
Merge remote-tracking branch 'jk/vfs' into work.misc
2016-10-08 11:06:08 -04:00
sysfs: Do not return POSIX ACL xattrs via listxattr
2018-10-10 08:53:22 +02:00
0c41beebcd