Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1279496

Re: [PATCH 2.6.32 19/38] [PATCH 19/38] pagemap: hide physical addresses from non-privileged users

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

On Sun, 2015-11-29 at 22:47 +0100, Willy Tarreau wrote:
> 2.6.32-longterm review patch.  If anyone has any objections, please let me know.
> 
> ------------------
> 
> commit 1c90308e7a77af6742a97d1021cca923b23b7f0d upstream.
> 
> This patch makes pagemap readable for normal users and hides physical
> addresses from them.  For some use-cases PFN isn't required at all.
> 
> See http://lkml.kernel.org/r/1425935472-17949-1-git-send-email-kirill@shutemov.name
> 
> Fixes: ab676b7d6fbf ("pagemap: do not leak physical addresses to non-privileged userspace")
> Signed-off-by: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
> Cc: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
> Reviewed-by: Mark Williamson <mwilliamson@undo-software.com>
> Tested-by:  Mark Williamson <mwilliamson@undo-software.com>
> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
> [bwh: Backported to 3.2:
>  - Add the same check in the places where we look up a PFN
>  - Add struct pagemapread * parameters where necessary
>  - Open-code file_ns_capable()
>  - Delete pagemap_open() entirely, as it would always return 0]
> Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
> (cherry picked from commit b1fb185f26e85f76e3ac6ce557398d78797c9684)
> [wt: adjusted context, no pagemap_hugetlb_range() in 2.6.32, and
>  security_capable() only takes a capability. Tested OK. ]
[...]
> +	/* do not disclose physical addresses: attack vector */
> +	pm.show_pfn = !security_capable(CAP_SYS_ADMIN);
[...]

This is wrong; see
<https://marc.info/?l=linux-api&m=143144321020852&w=2>.

For 2.6.32 perhaps you could retain the capability check at open time
but store the result in private state for use at read time.

The ptrace check presumably should also be done at open time, as was
implemented upstream in:

commit a06db751c321546e5563041956a57613259c6720
Author: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
Date:   Tue Sep 8 14:59:59 2015 -0700

    pagemap: check permissions and capabilities at open time

But that wasn't cc'd to stable and hasn't been applied to any stable
branch (yet).

Ben.

-- 
Ben Hutchings
Who are all these weirdos? - David Bowie, reading IRC for the first time

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 2.6.32 19/38] [PATCH 19/38] pagemap: hide physical addresses from non-privileged  users Willy Tarreau <w@1wt.eu> - 2015-11-29 23:10 +0100
  Re: [PATCH 2.6.32 19/38] [PATCH 19/38] pagemap: hide physical  addresses from non-privileged users Ben Hutchings <ben@decadent.org.uk> - 2015-11-30 03:00 +0100
    Re: [PATCH 2.6.32 19/38] [PATCH 19/38] pagemap: hide physical addresses from non-privileged users Willy Tarreau <w@1wt.eu> - 2015-11-30 08:10 +0100
      Re: [PATCH 2.6.32 19/38] [PATCH 19/38] pagemap: hide physical addresses from non-privileged users Willy Tarreau <w@1wt.eu> - 2015-11-30 12:40 +0100
        Re: [PATCH 2.6.32 19/38] [PATCH 19/38] pagemap: hide physical  addresses from non-privileged users Konstantin Khlebnikov <khlebnikov@yandex-team.ru> - 2015-11-30 13:00 +0100
          Re: [PATCH 2.6.32 19/38] [PATCH 19/38] pagemap: hide physical addresses from non-privileged users Willy Tarreau <w@1wt.eu> - 2015-11-30 13:20 +0100
        Re: [PATCH 2.6.32 19/38] [PATCH 19/38] pagemap: hide physical  addresses from non-privileged users Ben Hutchings <ben@decadent.org.uk> - 2015-11-30 16:00 +0100
          Re: [PATCH 2.6.32 19/38] [PATCH 19/38] pagemap: hide physical addresses from non-privileged users Willy Tarreau <w@1wt.eu> - 2015-11-30 16:20 +0100

csiph-web