[PATCH 0/2] exec: Use sane stack rlimit for setuid exec

From	Kees Cook <keescook@chromium.org>
Newsgroups	linux.kernel
Subject	[PATCH 0/2] exec: Use sane stack rlimit for setuid exec
Date	2017-07-07 22:00 +0200
Message-ID	<u0HzX-bF-3@gated-at.bofh.it> (permalink)
Organization	linux.* mail to news gateway

Show all headers | View raw

As discussed with Linus and Andy, we need to reset the stack rlimit
before we do memory layouts when execing a privilege-gaining (e.g.
setuid) program. This moves security_bprm_secureexec() earlier (with
required changes), and then lowers the stack limit when appropriate.

As a side-effect, dumpability is expanded to cover capabilities and
other LSM definitions of secureexec, and Smack can drop its special
handler for pdeath_signal clearing.

I'd appreciate some extra eyes on this to make sure this isn't
broken in some special way. I couldn't find anything that _depended_
on security_bprm_secureexec() being called late.

Thanks!

-Kees

Back to linux.kernel | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

[PATCH 0/2] exec: Use sane stack rlimit for setuid exec Kees Cook <keescook@chromium.org> - 2017-07-07 22:00 +0200
  Re: [PATCH 0/2] exec: Use sane stack rlimit for setuid exec Linus Torvalds <torvalds@linux-foundation.org> - 2017-07-07 22:10 +0200
    Re: [PATCH 0/2] exec: Use sane stack rlimit for setuid exec Linus Torvalds <torvalds@linux-foundation.org> - 2017-07-07 22:20 +0200
      Re: [PATCH 0/2] exec: Use sane stack rlimit for setuid exec Kees Cook <keescook@chromium.org> - 2017-07-08 00:20 +0200
    Re: [PATCH 0/2] exec: Use sane stack rlimit for setuid exec Kees Cook <keescook@chromium.org> - 2017-07-08 00:20 +0200
      Re: [PATCH 0/2] exec: Use sane stack rlimit for setuid exec Linus Torvalds <torvalds@linux-foundation.org> - 2017-07-08 00:50 +0200
    Re: [PATCH 0/2] exec: Use sane stack rlimit for setuid exec Kees Cook <keescook@chromium.org> - 2017-07-08 06:00 +0200
  Re: [PATCH 0/2] exec: Use sane stack rlimit for setuid exec Andy Lutomirski <luto@kernel.org> - 2017-07-08 00:00 +0200
    Re: [PATCH 0/2] exec: Use sane stack rlimit for setuid exec Kees Cook <keescook@chromium.org> - 2017-07-08 00:20 +0200

csiph-web