From patchwork Mon May 18 17:36:59 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg Kroah-Hartman X-Patchwork-Id: 225574 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id C44F8C433E1 for ; Mon, 18 May 2020 18:26:55 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 9D7E320657 for ; Mon, 18 May 2020 18:26:55 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1589826415; bh=Kr0RiHN8SqbbMMjfNPM6EqrkZ89tVDlgdXlRto14bHo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=kNM/OFSYNH6ppEiubFbRfcMAb2VhiVFJpj/2bKJCw7Nw6Tje6c2kaRm3WTGeqdG9X ckQaKmzaeifxWhWt2YzmSYRmQtt15dG9hb3+0j/RySTgr4p37Lsegby1VhebN6aIez ek8krnglWsrV6gBgEPmMPVbDvr4arH7YoJQ6OFqY= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729837AbgERRpB (ORCPT ); Mon, 18 May 2020 13:45:01 -0400 Received: from mail.kernel.org ([198.145.29.99]:43518 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729829AbgERRo6 (ORCPT ); Mon, 18 May 2020 13:44:58 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 7D19920657; Mon, 18 May 2020 17:44:57 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1589823897; bh=Kr0RiHN8SqbbMMjfNPM6EqrkZ89tVDlgdXlRto14bHo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=mWs+Xln5paCYKzBzp3TZDGJ0MtLNveUKR9S/RdtThvJMl4v0h8UlyjgSe6Q+IGxMv aFMLtU0QwrGpnurD/1gBSbFjCnjQXj90N9PGfC4eQy1+8FwPObz0GsDI1e0TQMqnGJ KjhOODs2RxvYaqcu5DVGaVPuAoNMYj/+OMz9Kydo= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, "Eric W. Biederman" Subject: [PATCH 4.9 81/90] exec: Move would_dump into flush_old_exec Date: Mon, 18 May 2020 19:36:59 +0200 Message-Id: <20200518173507.703925788@linuxfoundation.org> X-Mailer: git-send-email 2.26.2 In-Reply-To: <20200518173450.930655662@linuxfoundation.org> References: <20200518173450.930655662@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Eric W. Biederman commit f87d1c9559164294040e58f5e3b74a162bf7c6e8 upstream. I goofed when I added mm->user_ns support to would_dump. I missed the fact that in the case of binfmt_loader, binfmt_em86, binfmt_misc, and binfmt_script bprm->file is reassigned. Which made the move of would_dump from setup_new_exec to __do_execve_file before exec_binprm incorrect as it can result in would_dump running on the script instead of the interpreter of the script. The net result is that the code stopped making unreadable interpreters undumpable. Which allows them to be ptraced and written to disk without special permissions. Oops. The move was necessary because the call in set_new_exec was after bprm->mm was no longer valid. To correct this mistake move the misplaced would_dump from __do_execve_file into flos_old_exec, before exec_mmap is called. I tested and confirmed that without this fix I can attach with gdb to a script with an unreadable interpreter, and with this fix I can not. Cc: stable@vger.kernel.org Fixes: f84df2a6f268 ("exec: Ensure mm->user_ns contains the execed files") Signed-off-by: "Eric W. Biederman" Signed-off-by: Greg Kroah-Hartman --- fs/exec.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/fs/exec.c +++ b/fs/exec.c @@ -1270,6 +1270,8 @@ int flush_old_exec(struct linux_binprm * */ set_mm_exe_file(bprm->mm, bprm->file); + would_dump(bprm, bprm->file); + /* * Release all of the old mmap stuff */ @@ -1780,8 +1782,6 @@ static int do_execveat_common(int fd, st if (retval < 0) goto out; - would_dump(bprm, bprm->file); - retval = exec_binprm(bprm); if (retval < 0) goto out;