aboutsummaryrefslogtreecommitdiffstats
path: root/fs
diff options
context:
space:
mode:
authorNick Desaulniers <ndesaulniers@google.com>2016-11-18 10:44:16 -0800
committerAndreas Blaesius <skate4life@gmx.de>2017-03-17 11:02:23 +0100
commit22837db7f47b8147a31f06c4c064d4268798a8bc (patch)
tree332abb964c35e55e96c8d239715aa10d4bb7bb60 /fs
parentea76dfd7919a21cdc91c0820b18c05af9c5ea30c (diff)
downloadkernel_samsung_espresso10-22837db7f47b8147a31f06c4c064d4268798a8bc.zip
kernel_samsung_espresso10-22837db7f47b8147a31f06c4c064d4268798a8bc.tar.gz
kernel_samsung_espresso10-22837db7f47b8147a31f06c4c064d4268798a8bc.tar.bz2
BACKPORT: aio: mark AIO pseudo-fs noexec
This ensures that do_mmap() won't implicitly make AIO memory mappings executable if the READ_IMPLIES_EXEC personality flag is set. Such behavior is problematic because the security_mmap_file LSM hook doesn't catch this case, potentially permitting an attacker to bypass a W^X policy enforced by SELinux. I have tested the patch on my machine. To test the behavior, compile and run this: #define _GNU_SOURCE #include <unistd.h> #include <sys/personality.h> #include <linux/aio_abi.h> #include <err.h> #include <stdlib.h> #include <stdio.h> #include <sys/syscall.h> int main(void) { personality(READ_IMPLIES_EXEC); aio_context_t ctx = 0; if (syscall(__NR_io_setup, 1, &ctx)) err(1, "io_setup"); char cmd[1000]; sprintf(cmd, "cat /proc/%d/maps | grep -F '/[aio]'", (int)getpid()); system(cmd); return 0; } In the output, "rw-s" is good, "rwxs" is bad. Signed-off-by: Jann Horn <jann@thejh.net> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> (cherry picked from commit 22f6b4d34fcf039c63a94e7670e0da24f8575a5a) Bug: 31711619 Change-Id: I9f2872703bef240d6b82320c744529459bb076dc
Diffstat (limited to 'fs')
-rw-r--r--fs/aio.c4
1 files changed, 4 insertions, 0 deletions
diff --git a/fs/aio.c b/fs/aio.c
index 57a560d..c1c5d59 100644
--- a/fs/aio.c
+++ b/fs/aio.c
@@ -35,6 +35,7 @@
#include <linux/eventfd.h>
#include <linux/blkdev.h>
#include <linux/compat.h>
+#include <linux/personality.h>
#include <asm/kmap_types.h>
#include <asm/uaccess.h>
@@ -112,6 +113,9 @@ static int aio_setup_ring(struct kioctx *ctx)
unsigned long size;
int nr_pages;
+ if (current->personality & READ_IMPLIES_EXEC)
+ return -EPERM;
+
/* Compensate for the ring buffer's head/tail overlap entry */
nr_events += 2; /* 1 is required, 2 for good luck */