Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1568832 > unrolled thread
| Started by | Andy Lutomirski <luto@kernel.org> |
|---|---|
| First post | 2017-01-28 04:00 +0100 |
| Last post | 2017-01-31 05:00 +0100 |
| Articles | 3 — 3 participants |
Back to article view | Back to linux.kernel
[PATCH v2 0/2] setgid hardening Andy Lutomirski <luto@kernel.org> - 2017-01-28 04:00 +0100
Re: [PATCH v2 0/2] setgid hardening Michael Kerrisk <mtk.manpages@gmail.com> - 2017-01-31 05:00 +0100
Re: [PATCH v2 0/2] setgid hardening Andy Lutomirski <luto@amacapital.net> - 2017-01-31 05:00 +0100
| From | Andy Lutomirski <luto@kernel.org> |
|---|---|
| Date | 2017-01-28 04:00 +0100 |
| Subject | [PATCH v2 0/2] setgid hardening |
| Message-ID | <t4rp7-3Yv-3@gated-at.bofh.it> |
The kernel has some dangerous behavior involving the creation and modification of setgid executables. These issues aren't kernel security bugs per se, but they have been used to turn various filesystem permission oddities into reliably privilege escalation exploits. See http://www.halfdog.net/Security/2015/SetgidDirectoryPrivilegeEscalation/ for a nice writeup. Let's fix them for real. Changes from v1: - Fix uninitialized variable issue (Willy, Ben) - Also check current creds in should_remove_suid() (Ben) Andy Lutomirski (2): fs: Check f_cred as well as of current's creds in should_remove_suid() fs: Harden against open(..., O_CREAT, 02777) in a setgid directory fs/inode.c | 61 ++++++++++++++++++++++++++++++++++++++++++++++-------- fs/internal.h | 2 +- fs/ocfs2/file.c | 4 ++-- fs/open.c | 2 +- include/linux/fs.h | 2 +- 5 files changed, 57 insertions(+), 14 deletions(-) -- 2.9.3
[toc] | [next] | [standalone]
| From | Michael Kerrisk <mtk.manpages@gmail.com> |
|---|---|
| Date | 2017-01-31 05:00 +0100 |
| Message-ID | <t5xLP-4aI-1@gated-at.bofh.it> |
| In reply to | #1568832 |
[CC += linux-api@] Andy, this is an API change! On Sat, Jan 28, 2017 at 3:49 PM, Andy Lutomirski <luto@kernel.org> wrote: > The kernel has some dangerous behavior involving the creation and > modification of setgid executables. These issues aren't kernel > security bugs per se, but they have been used to turn various > filesystem permission oddities into reliably privilege escalation > exploits. > > See http://www.halfdog.net/Security/2015/SetgidDirectoryPrivilegeEscalation/ > for a nice writeup. > > Let's fix them for real. > > Changes from v1: > - Fix uninitialized variable issue (Willy, Ben) > - Also check current creds in should_remove_suid() (Ben) > > Andy Lutomirski (2): > fs: Check f_cred as well as of current's creds in should_remove_suid() > fs: Harden against open(..., O_CREAT, 02777) in a setgid directory > > fs/inode.c | 61 ++++++++++++++++++++++++++++++++++++++++++++++-------- > fs/internal.h | 2 +- > fs/ocfs2/file.c | 4 ++-- > fs/open.c | 2 +- > include/linux/fs.h | 2 +- > 5 files changed, 57 insertions(+), 14 deletions(-) > > -- > 2.9.3 > > -- > To unsubscribe, send a message with 'unsubscribe linux-mm' in > the body to majordomo@kvack.org. For more info on Linux MM, > see: http://www.linux-mm.org/ . > Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a> -- Michael Kerrisk Linux man-pages maintainer; http://www.kernel.org/doc/man-pages/ Author of "The Linux Programming Interface", http://blog.man7.org/
[toc] | [prev] | [next] | [standalone]
| From | Andy Lutomirski <luto@amacapital.net> |
|---|---|
| Date | 2017-01-31 05:00 +0100 |
| Message-ID | <t5xLQ-4aI-21@gated-at.bofh.it> |
| In reply to | #1570299 |
On Mon, Jan 30, 2017 at 7:49 PM, Michael Kerrisk <mtk.manpages@gmail.com> wrote: > [CC += linux-api@] > > Andy, this is an API change! Indeed. I should be ashamed of myself! > > On Sat, Jan 28, 2017 at 3:49 PM, Andy Lutomirski <luto@kernel.org> wrote: >> The kernel has some dangerous behavior involving the creation and >> modification of setgid executables. These issues aren't kernel >> security bugs per se, but they have been used to turn various >> filesystem permission oddities into reliably privilege escalation >> exploits. >> >> See http://www.halfdog.net/Security/2015/SetgidDirectoryPrivilegeEscalation/ >> for a nice writeup. >> >> Let's fix them for real. >> >> Changes from v1: >> - Fix uninitialized variable issue (Willy, Ben) >> - Also check current creds in should_remove_suid() (Ben) >> >> Andy Lutomirski (2): >> fs: Check f_cred as well as of current's creds in should_remove_suid() >> fs: Harden against open(..., O_CREAT, 02777) in a setgid directory >> >> fs/inode.c | 61 ++++++++++++++++++++++++++++++++++++++++++++++-------- >> fs/internal.h | 2 +- >> fs/ocfs2/file.c | 4 ++-- >> fs/open.c | 2 +- >> include/linux/fs.h | 2 +- >> 5 files changed, 57 insertions(+), 14 deletions(-) >> >> -- >> 2.9.3 >> >> -- >> To unsubscribe, send a message with 'unsubscribe linux-mm' in >> the body to majordomo@kvack.org. For more info on Linux MM, >> see: http://www.linux-mm.org/ . >> Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a> > > > > -- > Michael Kerrisk Linux man-pages maintainer; > http://www.kernel.org/doc/man-pages/ > Author of "The Linux Programming Interface", http://blog.man7.org/ -- Andy Lutomirski AMA Capital Management, LLC
[toc] | [prev] | [standalone]
Back to top | Article view | linux.kernel
csiph-web