Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1700537
| From | Kees Cook <keescook@chromium.org> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | Re: [PATCH v4 00/15] exec: Use sane stack rlimit under secureexec |
| Date | 2017-08-01 02:40 +0200 |
| Message-ID | <u9to6-4FV-3@gated-at.bofh.it> (permalink) |
| References | <u9sLn-4eo-5@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
Ugh, please ignore this v4. There's a typo that snuck in. I'll send a v5 soon...
-Kees
On Mon, Jul 31, 2017 at 4:51 PM, Kees Cook <keescook@chromium.org> wrote:
> As discussed with Linus and Andy, we need to reset the stack rlimit
> before we do memory layouts when execing a privilege-gaining (e.g.
> setuid) program. To do this, we need to know the results of the
> bprm_secureexec hook before memory layouts. As it turns out, this
> can be made _mostly_ trivial by collapsing bprm_secureexec into
> bprm_set_creds.
>
> The LSMs using bprm_secureexec nearly always save state between
> bprm_set_creds and bprm_secureexec. In the face of multiple calls to
> bprm_set_creds (via prepare_binprm() calls from binfmt_script, etc),
> all LSMs except commoncap only pay attention to the first call, so
> that aligns well with collapsing bprm_secureexec into bprm_set_creds.
> The commoncaps, though, needs to check the _last_ bprm_set_creds, so
> this series just swaps one bprm flag for another (cap_effective is no
> longer needed to save state between bprm_set_creds and bprm_secureexec,
> but we do need to keep a separate state, so we add the cap_elevated flag).
>
> Once secureexec is available to setup_new_exec() before the memory
> layout, we can add an rlimit sanity-check for setuid execs. (With no
> need to clean up since we're past the point of no return.)
>
> Along the way, this fixes comments, renames a variable, and consolidates
> dumpability and pdeath_signal clearing, which includes some commit log
> archeology to examine the subtle differences between what we had and
> what we need.
>
> Several folks have looked at this already (thank you!) but I'd appreciate
> any other eyes on this to make sure it isn't broken in some special
> way. Looking at the diffstat, even after all my long comments, this is
> a net reduction in lines. :)
>
> Given this crosses a bunch of areas, I think this is likely best to go
> via the -mm tree, which is where nearly all of my prior exec work has
> lived too. It's also after rc2 at this point, so I'd be slightly nervous
> to see this land directly in Linus's tree, but I leave that decision up
> to Linus. :) Regardless, very little has changed between v3 and v4, so I
> think this is ready to go.
>
> Thanks!
>
> -Kees
>
> ----------------------------------------------------------------
> Kees Cook (15):
> exec: Rename bprm->cred_prepared to called_set_creds
> exec: Correct comments about "point of no return"
> binfmt: Introduce secureexec flag
> apparmor: Refactor to remove bprm_secureexec hook
> selinux: Refactor to remove bprm_secureexec hook
> smack: Refactor to remove bprm_secureexec hook
> commoncap: Refactor to remove bprm_secureexec hook
> commoncap: Move cap_elevated calculation into bprm_set_creds
> LSM: drop bprm_secureexec hook
> exec: Use secureexec for setting dumpability
> exec: Use secureexec for clearing pdeath_signal
> smack: Remove redundant pdeath_signal clearing
> exec: Consolidate dumpability logic
> exec: Use sane stack rlimit under secureexec
> exec: Consolidate pdeath_signal clearing
>
> fs/binfmt_elf.c | 2 +-
> fs/binfmt_elf_fdpic.c | 2 +-
> fs/binfmt_flat.c | 2 +-
> fs/exec.c | 56 ++++++++++++++++++++++++++++----------
> include/linux/binfmts.h | 24 ++++++++++++----
> include/linux/lsm_hooks.h | 14 ++++------
> include/linux/security.h | 7 -----
> security/apparmor/domain.c | 24 ++--------------
> security/apparmor/include/domain.h | 1 -
> security/apparmor/include/file.h | 3 --
> security/apparmor/lsm.c | 1 -
> security/commoncap.c | 50 ++++++++--------------------------
> security/security.c | 5 ----
> security/selinux/hooks.c | 26 ++++--------------
> security/smack/smack_lsm.c | 34 ++---------------------
> security/tomoyo/tomoyo.c | 2 +-
> 16 files changed, 91 insertions(+), 162 deletions(-)
>
> v4:
> - add {Ack,Review,Test}ed-bys
> - reorder patches to move trivial refactoring to the front
> - move secureexec flag set earlier in the series to setup_new_exec(); amluto
>
> v3:
> - collapse brpm_secureexec into bprm_set_creds; ebiederm.
> - continue to improve various comments
>
> v2:
> - fix missed current_security() uses in LSMs.
> - research/consolidate dumpability setting logic
> - research/consolidate pdeath_signal clearing logic
> - split up logical steps a little more for easier review (and bisection)
> - fix some old broken comments
>
>
--
Kees Cook
Pixel Security
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
[PATCH v4 00/15] exec: Use sane stack rlimit under secureexec Kees Cook <keescook@chromium.org> - 2017-08-01 02:00 +0200
[PATCH v4 02/15] exec: Correct comments about "point of no return" Kees Cook <keescook@chromium.org> - 2017-08-01 02:00 +0200
[PATCH v4 10/15] exec: Use secureexec for setting dumpability Kees Cook <keescook@chromium.org> - 2017-08-01 02:00 +0200
Re: [PATCH v4 10/15] exec: Use secureexec for setting dumpability James Morris <jmorris@namei.org> - 2017-08-01 02:50 +0200
[PATCH v4 08/15] commoncap: Move cap_elevated calculation into bprm_set_creds Kees Cook <keescook@chromium.org> - 2017-08-01 02:00 +0200
Re: [PATCH v4 08/15] commoncap: Move cap_elevated calculation into bprm_set_creds Andy Lutomirski <luto@kernel.org> - 2017-08-01 15:50 +0200
[PATCH v4 11/15] exec: Use secureexec for clearing pdeath_signal Kees Cook <keescook@chromium.org> - 2017-08-01 02:00 +0200
[PATCH v4 05/15] selinux: Refactor to remove bprm_secureexec hook Kees Cook <keescook@chromium.org> - 2017-08-01 02:00 +0200
Re: [PATCH v4 05/15] selinux: Refactor to remove bprm_secureexec hook James Morris <jmorris@namei.org> - 2017-08-01 02:50 +0200
Re: [PATCH v4 05/15] selinux: Refactor to remove bprm_secureexec hook Andy Lutomirski <luto@kernel.org> - 2017-08-01 15:30 +0200
[PATCH v4 09/15] LSM: drop bprm_secureexec hook Kees Cook <keescook@chromium.org> - 2017-08-01 02:00 +0200
[PATCH v4 01/15] exec: Rename bprm->cred_prepared to called_set_creds Kees Cook <keescook@chromium.org> - 2017-08-01 02:00 +0200
[PATCH v4 03/15] binfmt: Introduce secureexec flag Kees Cook <keescook@chromium.org> - 2017-08-01 02:00 +0200
Re: [PATCH v4 03/15] binfmt: Introduce secureexec flag Kees Cook <keescook@chromium.org> - 2017-08-01 02:30 +0200
Re: [PATCH v4 03/15] binfmt: Introduce secureexec flag James Morris <jmorris@namei.org> - 2017-08-01 02:50 +0200
[PATCH v4 06/15] smack: Refactor to remove bprm_secureexec hook Kees Cook <keescook@chromium.org> - 2017-08-01 02:00 +0200
Re: [PATCH v4 06/15] smack: Refactor to remove bprm_secureexec hook James Morris <jmorris@namei.org> - 2017-08-01 02:50 +0200
Re: [PATCH v4 06/15] smack: Refactor to remove bprm_secureexec hook Casey Schaufler <casey@schaufler-ca.com> - 2017-08-01 17:30 +0200
[PATCH v4 07/15] commoncap: Refactor to remove bprm_secureexec hook Kees Cook <keescook@chromium.org> - 2017-08-01 02:00 +0200
[PATCH v4 04/15] apparmor: Refactor to remove bprm_secureexec hook Kees Cook <keescook@chromium.org> - 2017-08-01 02:00 +0200
[PATCH v4 13/15] exec: Consolidate dumpability logic Kees Cook <keescook@chromium.org> - 2017-08-01 02:00 +0200
[PATCH v4 12/15] smack: Remove redundant pdeath_signal clearing Kees Cook <keescook@chromium.org> - 2017-08-01 02:00 +0200
Re: [PATCH v4 12/15] smack: Remove redundant pdeath_signal clearing James Morris <jmorris@namei.org> - 2017-08-01 03:00 +0200
Re: [PATCH v4 12/15] smack: Remove redundant pdeath_signal clearing Casey Schaufler <casey@schaufler-ca.com> - 2017-08-01 17:30 +0200
[PATCH v4 15/15] exec: Consolidate pdeath_signal clearing Kees Cook <keescook@chromium.org> - 2017-08-01 02:00 +0200
Re: [PATCH v4 00/15] exec: Use sane stack rlimit under secureexec Kees Cook <keescook@chromium.org> - 2017-08-01 02:40 +0200
Re: [PATCH v4 00/15] exec: Use sane stack rlimit under secureexec James Morris <jmorris@namei.org> - 2017-08-01 03:00 +0200
Re: [PATCH v4 00/15] exec: Use sane stack rlimit under secureexec Kees Cook <keescook@chromium.org> - 2017-08-01 05:10 +0200
Re: [PATCH v4 00/15] exec: Use sane stack rlimit under secureexec Linus Torvalds <torvalds@linux-foundation.org> - 2017-08-01 07:20 +0200
Re: [PATCH v4 00/15] exec: Use sane stack rlimit under secureexec Linus Torvalds <torvalds@linux-foundation.org> - 2017-08-01 07:20 +0200
Re: [PATCH v4 00/15] exec: Use sane stack rlimit under secureexec Kees Cook <keescook@chromium.org> - 2017-08-01 17:10 +0200
Re: [PATCH v4 00/15] exec: Use sane stack rlimit under secureexec Linus Torvalds <torvalds@linux-foundation.org> - 2017-08-01 22:20 +0200
Re: [PATCH v4 00/15] exec: Use sane stack rlimit under secureexec Kees Cook <keescook@chromium.org> - 2017-08-01 23:10 +0200
csiph-web