Salvatore Mesoraca
0c41beebcd
namei: allow restricted O_CREAT of FIFOs and regular files ...
commit 30aba6656f61ed44cba445a3c0d38b296fa9e8f5 upstream.
Disallows open of FIFOs or regular files not owned by the user in world
writable sticky directories, unless the owner is the same as that of the
directory or the file is opened without the O_CREAT flag. The purpose
is to make data spoofing attacks harder. This protection can be turned
on and off separately for FIFOs and regular files via sysctl, just like
the symlinks/hardlinks protection. This patch is based on Openwall's
"HARDEN_FIFO" feature by Solar Designer.
This is a brief list of old vulnerabilities that could have been prevented
by this feature, some of them even allow for privilege escalation:
CVE-2000-1134
CVE-2007-3852
CVE-2008-0525
CVE-2009-0416
CVE-2011-4834
CVE-2015-1838
CVE-2015-7442
CVE-2016-7489
This list is not meant to be complete. It's difficult to track down all
vulnerabilities of this kind because they were often reported without any
mention of this particular attack vector. In fact, before
hardlinks/symlinks restrictions, fifos/regular files weren't the favorite
vehicle to exploit them.
[s.mesoraca16@gmail.com: fix bug reported by Dan Carpenter]
Link: https://lkml.kernel.org/r/20180426081456.GA7060@mwanda
Link: http://lkml.kernel.org/r/1524829819-11275-1-git-send-email-s.mesoraca16@gmail.com
[keescook@chromium.org: drop pr_warn_ratelimited() in favor of audit changes in the future]
[keescook@chromium.org: adjust commit subjet]
Link: http://lkml.kernel.org/r/20180416175918.GA13494@beast
Signed-off-by: Salvatore Mesoraca <s.mesoraca16@gmail.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Suggested-by: Solar Designer <solar@openwall.com>
Suggested-by: Kees Cook <keescook@chromium.org>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Loic <hackurx@opensec.fr>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-12-01 09:44:25 +01:00
bpf: fix references to free_bpf_prog_info() in comments
2018-08-03 07:55:23 +02:00
config: android: enable CONFIG_SECCOMP
2016-10-11 15:06:32 -07:00
kdb: Use strscpy with destination buffer size
2018-12-01 09:44:21 +01:00
perf/core: Fix locking for children siblings group read
2018-11-10 07:42:54 -08:00
gcov: support GCC 7.1
2017-09-02 07:07:53 +02:00
genirq: Fix race on spurious interrupt detection
2018-11-13 11:17:01 -08:00
livepatch/module: make TAINT_LIVEPATCH module-specific
2016-08-26 14:42:08 +02:00
locking/lockdep: Fix debug_locks off performance problem
2018-11-13 11:16:48 -08:00
PM / sleep: wakeup: Fix build error caused by missing SRCU support
2018-09-09 20:01:23 +02:00
printk: Fix panic caused by passing log_buf_len to command line
2018-11-13 11:17:01 -08:00
rcu: Call touch_nmi_watchdog() while printing stall warnings
2018-05-30 07:50:50 +02:00
sched/core: Allow __sched_setscheduler() in interrupts when PI is not used
2018-12-01 09:44:25 +01:00
posix-timers: Sanitize overrun handling
2018-11-10 07:43:01 -08:00
ring-buffer: Allow for rescheduling when removing pages
2018-09-29 03:07:32 -07:00
kernel/acct.c: fix the acct->needcheck check in check_free_space()
2018-01-10 09:29:51 +01:00
kernel/async.c: revert "async: simplify lowest_in_progress()"
2018-02-17 13:21:18 +01:00
audit: return on memory error to avoid null pointer dereference
2018-05-30 07:50:49 +02:00
Merge branch 'stable-4.8' of git://git.infradead.org/users/pcmoore/audit
2016-07-29 17:54:17 -07:00
audit: cleanup prune_tree_thread
2016-04-04 09:46:47 -04:00
audit: fix use-after-free in audit_add_watch
2018-09-26 08:36:37 +02:00
audit: allow not equal op for audit by executable
2018-08-03 07:55:25 +02:00
audit: allow not equal op for audit by executable
2018-08-03 07:55:25 +02:00
kbuild: fix kernel/bounds.c 'W=1' warning
2018-11-13 11:16:57 -08:00
ptrace: Capture the ptracer's creds not PT_PTRACE_CAP
2017-01-06 10:40:13 +01:00
cgroup: Fix deadlock in cpu hotplug path
2018-10-13 09:18:56 +02:00
cgroup/pids: remove spurious suspicious RCU usage warning
2017-03-26 13:05:58 +02:00
Revert "x86/speculation: Enable cross-hyperthread spectre v2 STIBP mitigation"
2018-11-23 12:57:41 +01:00
sched/cpuset/pm: Fix cpuset vs. suspend-resume bugs
2017-10-12 11:51:25 +02:00
cred: Reject inodes with invalid ids in set_create_file_as()
2016-06-30 18:05:09 -05:00
kernel/exit.c: avoid undefined behaviour when calling wait4()
2018-05-19 10:27:01 +02:00
kernel/extable.c: mark core_kernel_text notrace
2017-07-21 07:42:21 +02:00
kthread: Fix use-after-free if kthread fork fails
2018-09-19 22:47:10 +02:00
freezer, oom: check TIF_MEMDIE on the correct task
2016-07-28 16:07:41 -07:00
futex: futex_wake_op, do not fail on invalid op
2018-11-10 07:42:54 -08:00
kernel: make groups_sort calling a responsibility group_info allocators
2018-01-10 09:29:52 +01:00
hung_task: allow hung_task_panic when hung_task_warnings is 0
2016-10-11 15:06:33 -07:00
jump_label: Invoke jump_label_test() via early_initcall()
2017-12-14 09:28:24 +01:00
kallsyms: add support for relative offsets in kallsyms address table
2016-03-15 16:55:16 -07:00
kcov: ensure irq code sees a valid area
2018-08-03 07:55:12 +02:00
kexec: allow architectures to override boot mapping
2016-08-02 19:35:27 -04:00
objtool, x86: Add several functions and files to the objtool whitelist
2018-06-05 10:28:57 +02:00
kexec: fix double-free when failing to relocate the purgatory
2016-09-01 17:52:01 -07:00
kprobes: Return error if we fail to reuse kprobe instead of BUG_ON()
2018-11-13 11:16:50 -08:00
kexec: add a kexec_crash_loaded() function
2016-08-02 19:35:30 -04:00
kthread, tracing: Don't expose half-written comm when creating kthreads
2018-08-03 07:55:12 +02:00
kernel/watchdog.c: move hardlockup detector to separate file
2017-06-17 06:41:57 +02:00
Fix: Disable sys_membarrier when nohz_full is enabled
2017-03-12 06:41:45 +01:00
mm: Fix devm_memremap_pages() collision handling
2018-02-28 10:18:34 +01:00
module: exclude SHN_UNDEF symbols from kallsyms api
2018-10-03 17:01:48 -07:00
KEYS: Move the point of trust determination to __key_link()
2016-04-11 22:43:43 +01:00
padata: free correct variable
2017-05-20 14:28:40 +02:00
kernel/panic.c: add missing \n
2017-07-05 14:40:24 +02:00
pidns: disable pid allocation if pid_ns_prepare_proc() is failed in alloc_pid()
2018-04-13 19:47:53 +02:00
pid_ns: Sleep in TASK_INTERRUPTIBLE in zap_pid_ns_processes
2017-05-25 15:44:38 +02:00
profile: Convert to hotplug state machine
2016-07-15 10:41:42 +02:00
ptrace: Properly initialize ptracer_cred on fork
2017-06-14 15:05:54 +02:00
kernel/relay.c: limit kmalloc size to KMALLOC_MAX_SIZE
2018-05-30 07:50:29 +02:00
resource: fix integer overflow at reallocation
2018-04-24 09:34:09 +02:00
seccomp: Move speculation migitation control to arch code
2018-05-22 16:58:02 +02:00
signal: Always deliver the kernel's SIGKILL and SIGSTOP to a pid namespace init
2018-11-13 11:16:53 -08:00
cpu/hotplug: Fix SMT supported evaluation
2018-08-15 18:14:53 +02:00
kthread/smpboot: do not park in kthread_create_on_cpu()
2016-10-11 15:06:33 -07:00
Mark HI and TASKLET softirq synchronous
2018-08-15 18:14:42 +02:00
stacktrace, lockdep: Fix address, newline ugliness
2017-02-14 15:25:42 -08:00
stop_machine: Use raw spinlocks
2018-08-03 07:55:24 +02:00
sys: don't hold uts_sem while accessing userspace memory
2018-09-09 20:01:24 +02:00
x86/pkeys: Fix pkeys build breakage for some non-x86 arches
2016-09-13 14:41:36 +02:00
namei: allow restricted O_CREAT of FIFOs and regular files
2018-12-01 09:44:25 +01:00
kernel/sysctl_binary.c: use generic UUID library
2016-05-20 17:58:30 -07:00
task_work: use READ_ONCE/lockless_dereference, avoid pi_lock if !task_works
2016-08-02 19:35:02 -04:00
taskstats: fix the length of cgroupstats_cmd_get_policy
2016-11-03 16:55:58 -04:00
torture: Convert torture_shutdown() to hrtimer
2016-08-22 10:01:49 -07:00
tracepoint: Do not warn on ENOMEM
2018-05-09 09:50:20 +02:00
kernel/ucount.c: mark user_header with kmemleak_ignore()
2017-06-17 06:41:51 +02:00
kernel: make groups_sort calling a responsibility group_info allocators
2018-01-10 09:29:52 +01:00
smp: Add function to execute a function synchronously on a CPU
2016-09-05 13:52:39 +02:00
userns: move user access out of the mutex
2018-09-09 20:01:24 +02:00
Merge branch 'nsfs-ioctls' into HEAD
2016-09-22 20:00:36 -05:00
sys: don't hold uts_sem while accessing userspace memory
2018-09-09 20:01:24 +02:00
kernel/watchdog: prevent false hardlockup on overloaded system
2017-06-17 06:41:57 +02:00
kernel/watchdog: prevent false hardlockup on overloaded system
2017-06-17 06:41:57 +02:00
workqueue: use put_device() instead of kfree()
2018-05-30 07:50:36 +02:00
workqueue: Fix NULL pointer dereference
2017-11-15 15:53:17 +01:00
0c41beebcd