Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]


Groups > linux.kernel > #1542183

Re: [RFC 4/4] Introduce CONFIG_READONLY_USERMODEHELPER

From Kees Cook <keescook@chromium.org>
Newsgroups linux.kernel
Subject Re: [RFC 4/4] Introduce CONFIG_READONLY_USERMODEHELPER
Date 2016-12-14 21:40 +0100
Message-ID <sOovf-3SD-29@gated-at.bofh.it> (permalink)
References <sOmMO-1X4-21@gated-at.bofh.it> <sOmWt-229-15@gated-at.bofh.it>
Organization linux.* mail to news gateway

Show all headers | View raw


On Wed, Dec 14, 2016 at 10:51 AM, Greg KH <gregkh@linuxfoundation.org> wrote:
> If you can write to kernel memory, an "easy" way to get the kernel to
> run any application is to change the pointer of one of the usermode
> helper program names.  To try to mitigate this, create a new config
> option, CONFIG_READONLY_USERMODEHELPER.
>
> This option only allows "predefined" binaries to be called.  A number of
> drivers and subsystems allow for the name of the binary to be changed,
> and this config option disables that capability, so be aware of that.
>
> Note:  Still a proof-of-concept at this point in time, doesn't cover all
> of the call_usermodehelper() calls just yet, including the "fun" of
> coredumps, it's still a work in progress.
>
> Not-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> ---
>  arch/x86/kernel/cpu/mcheck/mce.c | 12 ++++++++----
>  drivers/block/drbd/drbd_int.h    |  6 +++++-
>  drivers/block/drbd/drbd_main.c   |  5 +++++
>  drivers/video/fbdev/uvesafb.c    | 19 ++++++++++++++-----
>  fs/nfs/cache_lib.c               | 12 ++++++++++--
>  include/linux/reboot.h           |  2 ++
>  kernel/ksysfs.c                  |  6 +++++-
>  kernel/reboot.c                  |  3 +++
>  kernel/sysctl.c                  |  4 ++++
>  lib/kobject_uevent.c             |  3 +++
>  security/Kconfig                 | 17 +++++++++++++++++
>  11 files changed, 76 insertions(+), 13 deletions(-)
>
> diff --git a/arch/x86/kernel/cpu/mcheck/mce.c b/arch/x86/kernel/cpu/mcheck/mce.c
> index 00ef43233e03..92a2ef8ffe3e 100644
> --- a/arch/x86/kernel/cpu/mcheck/mce.c
> +++ b/arch/x86/kernel/cpu/mcheck/mce.c
> @@ -2337,15 +2337,16 @@ static ssize_t set_bank(struct device *s, struct device_attribute *attr,
>  }
>
>  static ssize_t
> -show_trigger(struct device *s, struct device_attribute *attr, char *buf)
> +trigger_show(struct device *s, struct device_attribute *attr, char *buf)
>  {
>         strcpy(buf, mce_helper);
>         strcat(buf, "\n");
>         return strlen(mce_helper) + 1;

The +1 is wrong, AFAICT. Also, is speed really needed here?

    return scnprintf(buf, PAGE_SIZE, "%s\n", mce_helper);

is more readable...

> -static ssize_t set_trigger(struct device *s, struct device_attribute *attr,
> -                               const char *buf, size_t siz)
> +#ifndef CONFIG_READONLY_USERMODEHELPER
> +static ssize_t trigger_store(struct device *s, struct device_attribute *attr,
> +                            const char *buf, size_t siz)
>  {
>         char *p;
>
> @@ -2358,6 +2359,10 @@ static ssize_t set_trigger(struct device *s, struct device_attribute *attr,
>
>         return strlen(mce_helper) + !!p;
>  }
> +static DEVICE_ATTR_RW(trigger);
> +#else
> +static DEVICE_ATTR_RO(trigger);
> +#endif
>
>  static ssize_t set_ignore_ce(struct device *s,
>                              struct device_attribute *attr,
> @@ -2415,7 +2420,6 @@ static ssize_t store_int_with_restart(struct device *s,
>         return ret;
>  }
>
> -static DEVICE_ATTR(trigger, 0644, show_trigger, set_trigger);
>  static DEVICE_INT_ATTR(tolerant, 0644, mca_cfg.tolerant);
>  static DEVICE_INT_ATTR(monarch_timeout, 0644, mca_cfg.monarch_timeout);
>  static DEVICE_BOOL_ATTR(dont_log_ce, 0644, mca_cfg.dont_log_ce);
> diff --git a/drivers/block/drbd/drbd_int.h b/drivers/block/drbd/drbd_int.h
> index a139a34f1f1e..e21ab2bcc482 100644
> --- a/drivers/block/drbd/drbd_int.h
> +++ b/drivers/block/drbd/drbd_int.h
> @@ -75,7 +75,11 @@ extern int fault_rate;
>  extern int fault_devs;
>  #endif
>
> -extern char drbd_usermode_helper[];
> +extern
> +#ifdef CONFIG_READONLY_USERMODEHELPER
> +       const
> +#endif
> +             char drbd_usermode_helper[];

This #ifdef; const; #endif is repeated a few times. Perhaps better to
create a separate macro:

#ifdef CONFIG_READONLY_USERMODEHELPER
# define __ro_umh const
#else
# define __ro_umh /**/
#endif

...

extern __ro_umh char drbd_usermode_helper[];



-Kees

-- 
Kees Cook
Nexus Security

Back to linux.kernel | Previous | NextPrevious in thread | Next in thread | Find similar | Unroll thread


Thread

[RFC 0/4] make call_usermodehelper a bit more "safe" Greg KH <gregkh@linuxfoundation.org> - 2016-12-14 19:50 +0100
  [PATCH 1/4] kmod: make usermodehelper path a const string Greg KH <gregkh@linuxfoundation.org> - 2016-12-14 20:00 +0100
  [PATCH 3/4] Make static usermode helper binaries constant Greg KH <gregkh@linuxfoundation.org> - 2016-12-14 20:00 +0100
    Re: [kernel-hardening] [PATCH 3/4] Make static usermode helper  binaries constant Greg KH <gregkh@linuxfoundation.org> - 2016-12-14 20:20 +0100
    Re: [kernel-hardening] [PATCH 3/4] Make static usermode helper  binaries constant Rich Felker <dalias@libc.org> - 2016-12-14 21:40 +0100
      Re: [kernel-hardening] [PATCH 3/4] Make static usermode helper  binaries constant Greg KH <greg@kroah.com> - 2016-12-14 22:00 +0100
        Re: [kernel-hardening] [PATCH 3/4] Make static usermode helper  binaries constant Greg KH <greg@kroah.com> - 2016-12-15 19:00 +0100
          Re: [kernel-hardening] [PATCH 3/4] Make static usermode helper  binaries constant Daniel Micay <danielmicay@gmail.com> - 2016-12-15 22:00 +0100
            Re: [kernel-hardening] [PATCH 3/4] Make static usermode helper  binaries constant Greg KH <gregkh@linuxfoundation.org> - 2016-12-15 22:20 +0100
              Re: [kernel-hardening] [PATCH 3/4] Make static usermode helper  binaries constant Daniel Micay <danielmicay@gmail.com> - 2016-12-16 01:10 +0100
                Re: [kernel-hardening] [PATCH 3/4] Make static usermode helper  binaries constant Daniel Micay <danielmicay@gmail.com> - 2016-12-16 01:30 +0100
  [RFC 4/4] Introduce CONFIG_READONLY_USERMODEHELPER Greg KH <gregkh@linuxfoundation.org> - 2016-12-14 20:00 +0100
    Re: [RFC 4/4] Introduce CONFIG_READONLY_USERMODEHELPER Kees Cook <keescook@chromium.org> - 2016-12-14 21:40 +0100
      Re: [RFC 4/4] Introduce CONFIG_READONLY_USERMODEHELPER Greg KH <gregkh@linuxfoundation.org> - 2016-12-14 22:10 +0100
  [PATCH 2/4] drbd: rename "usermode_helper" to "drbd_usermode_helper" Greg KH <gregkh@linuxfoundation.org> - 2016-12-14 20:00 +0100
  Re: [kernel-hardening] [RFC 0/4] make call_usermodehelper a bit more  "safe" Mark Rutland <mark.rutland@arm.com> - 2016-12-14 20:30 +0100
    Re: [kernel-hardening] [RFC 0/4] make call_usermodehelper a bit more "safe" Kees Cook <keescook@chromium.org> - 2016-12-14 21:20 +0100
  Re: [kernel-hardening] [RFC 0/4] make call_usermodehelper a bit more "safe" "Jason A. Donenfeld" <Jason@zx2c4.com> - 2016-12-14 22:30 +0100
    Re: [kernel-hardening] [RFC 0/4] make call_usermodehelper a bit more  "safe" Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-12-15 00:20 +0100
  Re: [RFC 0/4] make call_usermodehelper a bit more "safe" NeilBrown <neilb@suse.com> - 2016-12-16 02:10 +0100
    Re: [RFC 0/4] make call_usermodehelper a bit more "safe" Greg KH <gregkh@linuxfoundation.org> - 2016-12-16 14:00 +0100
      Re: [RFC 0/4] make call_usermodehelper a bit more "safe" Jiri Kosina <jikos@kernel.org> - 2016-12-19 14:40 +0100
        Re: [RFC 0/4] make call_usermodehelper a bit more "safe" Greg KH <gregkh@linuxfoundation.org> - 2016-12-20 10:30 +0100
          Re: [RFC 0/4] make call_usermodehelper a bit more "safe" Jiri Kosina <jikos@kernel.org> - 2016-12-20 11:30 +0100
            Re: [RFC 0/4] make call_usermodehelper a bit more "safe" Jiri Kosina <jikos@kernel.org> - 2016-12-20 11:40 +0100
              Re: [RFC 0/4] make call_usermodehelper a bit more "safe" Greg KH <gregkh@linuxfoundation.org> - 2016-12-20 11:50 +0100

csiph-web