Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1680402
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | [PATCH 4.4 029/101] sysctl: enable strict writes |
| Date | 2017-07-03 17:10 +0200 |
| Message-ID | <tZb99-3e8-41@gated-at.bofh.it> (permalink) |
| References | <tZ9K1-27f-3@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kees Cook <keescook@chromium.org>
commit 41662f5cc55335807d39404371cfcbb1909304c4 upstream.
SYSCTL_WRITES_WARN was added in commit f4aacea2f5d1 ("sysctl: allow for
strict write position handling"), and released in v3.16 in August of
2014. Since then I can find only 1 instance of non-zero offset
writing[1], and it was fixed immediately in CRIU[2]. As such, it
appears safe to flip this to the strict state now.
[1] https://www.google.com/search?q="when%20file%20position%20was%20not%200"
[2] http://lists.openvz.org/pipermail/criu/2015-April/019819.html
Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Sumit Semwal <sumit.semwal@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
Documentation/sysctl/kernel.txt | 15 +++++++--------
kernel/sysctl.c | 2 +-
2 files changed, 8 insertions(+), 9 deletions(-)
--- a/Documentation/sysctl/kernel.txt
+++ b/Documentation/sysctl/kernel.txt
@@ -810,14 +810,13 @@ via the /proc/sys interface:
Each write syscall must fully contain the sysctl value to be
written, and multiple writes on the same sysctl file descriptor
will rewrite the sysctl value, regardless of file position.
- 0 - (default) Same behavior as above, but warn about processes that
- perform writes to a sysctl file descriptor when the file position
- is not 0.
- 1 - Respect file position when writing sysctl strings. Multiple writes
- will append to the sysctl value buffer. Anything past the max length
- of the sysctl value buffer will be ignored. Writes to numeric sysctl
- entries must always be at file position 0 and the value must be
- fully contained in the buffer sent in the write syscall.
+ 0 - Same behavior as above, but warn about processes that perform writes
+ to a sysctl file descriptor when the file position is not 0.
+ 1 - (default) Respect file position when writing sysctl strings. Multiple
+ writes will append to the sysctl value buffer. Anything past the max
+ length of the sysctl value buffer will be ignored. Writes to numeric
+ sysctl entries must always be at file position 0 and the value must
+ be fully contained in the buffer sent in the write syscall.
==============================================================
--- a/kernel/sysctl.c
+++ b/kernel/sysctl.c
@@ -174,7 +174,7 @@ extern int no_unaligned_warning;
#define SYSCTL_WRITES_WARN 0
#define SYSCTL_WRITES_STRICT 1
-static int sysctl_writes_strict = SYSCTL_WRITES_WARN;
+static int sysctl_writes_strict = SYSCTL_WRITES_STRICT;
static int proc_do_cad_pid(struct ctl_table *table, int write,
void __user *buffer, size_t *lenp, loff_t *ppos);
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
[PATCH 4.4 000/101] 4.4.76-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 15:40 +0200
[PATCH 4.4 094/101] iommu/vt-d: Dont over-free page table directories Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 15:50 +0200
[PATCH 4.4 061/101] amd-xgbe: Check xgbe_init() return code Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 15:50 +0200
[PATCH 4.4 082/101] ravb: Fix use-after-free on `ifconfig eth0 down` Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 15:50 +0200
[PATCH 4.4 090/101] ARM: 8685/1: ensure memblock-limit is pmd-aligned Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 15:50 +0200
[PATCH 4.4 086/101] xfrm: Oops on error in pfkey_msg2xfrm_state() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 15:50 +0200
[PATCH 4.4 096/101] iommu/amd: Fix incorrect error handling in amd_iommu_bind_pasid() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 15:50 +0200
[PATCH 4.4 079/101] perf probe: Fix to show correct locations for events on modules Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 15:50 +0200
[PATCH 4.4 089/101] ARM64/ACPI: Fix BAD_MADT_GICC_ENTRY() macro implementation Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 15:50 +0200
[PATCH 4.4 057/101] net: sctp: fix array overrun read on sctp_timer_tbl Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 15:50 +0200
Re: [PATCH 4.4 057/101] net: sctp: fix array overrun read on sctp_timer_tbl Ben Hutchings <ben.hutchings@codethink.co.uk> - 2017-07-04 20:50 +0200
Re: [PATCH 4.4 057/101] net: sctp: fix array overrun read on sctp_timer_tbl Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-05 14:20 +0200
[PATCH 4.4 085/101] xfrm: NULL dereference on allocation failure Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 15:50 +0200
[PATCH 4.4 095/101] iommu: Handle default domain attach failure Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 15:50 +0200
Re: [PATCH 4.4 095/101] iommu: Handle default domain attach failure Ben Hutchings <ben.hutchings@codethink.co.uk> - 2017-07-05 21:00 +0200
[PATCH 4.4 053/101] gianfar: Do not reuse pages from emergency reserve Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 16:50 +0200
[PATCH 4.4 098/101] KVM: x86: fix emulation of RSM and IRET instructions Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 16:50 +0200
[PATCH 4.4 060/101] platform/x86: ideapad-laptop: handle ACPI event 1 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 16:50 +0200
[PATCH 4.4 091/101] x86/mpx: Correctly report do_mpx_bt_fault() failures to user-space Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 16:50 +0200
[PATCH 4.4 062/101] net: dsa: Check return value of phy_connect_direct() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 16:50 +0200
[PATCH 4.4 059/101] scsi: virtio_scsi: Reject commands when virtqueue is broken Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 16:50 +0200
[PATCH 4.4 058/101] xen-netfront: Fix Rx stall during network stress and OOM Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 16:50 +0200
[PATCH 4.4 097/101] cpufreq: s3c2416: double free on driver init error path Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 16:50 +0200
[PATCH 4.4 087/101] watchdog: bcm281xx: Fix use of uninitialized spinlock. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:00 +0200
[PATCH 4.4 055/101] virtio_console: fix a crash in config_work_handler Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:00 +0200
[PATCH 4.4 056/101] swiotlb-xen: update dev_addr after swapping pages Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:00 +0200
[PATCH 4.4 093/101] ocfs2: o2hb: revert hb threshold to keep compatible Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:00 +0200
[PATCH 4.4 076/101] swiotlb: ensure that page-sized mappings are page-aligned Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:00 +0200
[PATCH 4.4 080/101] net/mlx4_core: Eliminate warning messages for SRQ_LIMIT under SRIOV Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:00 +0200
[PATCH 4.4 092/101] x86/mm: Fix flush_tlb_page() on Xen Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:00 +0200
[PATCH 4.4 088/101] sched/loadavg: Avoid loadavg spikes caused by delayed NO_HZ accounting Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:00 +0200
[PATCH 4.4 072/101] arm64: assembler: make adr_l work in modules under KASLR Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:00 +0200
Re: [PATCH 4.4 072/101] arm64: assembler: make adr_l work in modules under KASLR Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-04 11:30 +0200
Re: [PATCH 4.4 072/101] arm64: assembler: make adr_l work in modules under KASLR Ard Biesheuvel <ard.biesheuvel@linaro.org> - 2017-07-04 11:30 +0200
[PATCH 4.4 083/101] jump label: fix passing kbuild_cflags when checking for asm goto support Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:00 +0200
[PATCH 4.4 084/101] xfrm: fix stack access out of bounds with CONFIG_XFRM_SUB_POLICY Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:00 +0200
[PATCH 4.4 078/101] be2net: fix status check in be_cmd_pmac_add() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:00 +0200
[PATCH 4.4 081/101] sctp: check af before verify address in sctp_addr_id2transport Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:00 +0200
[PATCH 4.4 039/101] net: korina: Fix NAPI versus resources freeing Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:10 +0200
[PATCH 4.4 067/101] ibmveth: Add a proper check for the availability of the checksum features Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:10 +0200
[PATCH 4.4 010/101] ipv6: fix calling in6_ifa_hold incorrectly for dad work Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:10 +0200
[PATCH 4.4 035/101] qla2xxx: Fix erroneous invalid handle message Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:10 +0200
[PATCH 4.4 024/101] MIPS: Fix IRQ tracing & lockdep when rescheduling Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:10 +0200
[PATCH 4.4 018/101] netfilter: synproxy: fix conntrackd interaction Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:10 +0200
[PATCH 4.4 048/101] bgmac: Fix reversed test of build_skb() return value. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:10 +0200
[PATCH 4.4 015/101] ipv6: Do not leak throw route references Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:10 +0200
[PATCH 4.4 049/101] net: bgmac: Fix SOF bit checking Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:10 +0200
[PATCH 4.4 040/101] MIPS: ralink: MT7688 pinmux fixes Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:10 +0200
[PATCH 4.4 042/101] MIPS: ralink: Fix invalid assignment of SoC type Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:10 +0200
[PATCH 4.4 026/101] ALSA: hda - set input_path bitmap to zero after moving it to new place Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:10 +0200
[PATCH 4.4 030/101] block: fix module reference leak on put_disk() call for cgroups throttle Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:10 +0200
[PATCH 4.4 071/101] spi: davinci: use dma_mapping_error() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:10 +0200
Re: [PATCH 4.4 071/101] spi: davinci: use dma_mapping_error() Ben Hutchings <ben.hutchings@codethink.co.uk> - 2017-07-05 16:30 +0200
[PATCH 4.4 029/101] sysctl: enable strict writes Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:10 +0200
[PATCH 4.4 012/101] decnet: always not take dst->__refcnt when inserting dst into hash table Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:10 +0200
[PATCH 4.4 070/101] scsi: lpfc: avoid double free of resource identifiers Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:10 +0200
[PATCH 4.4 074/101] x86/mpx: Use compatible types in comparison to fix sparse error Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:10 +0200
[PATCH 4.4 025/101] ALSA: hda - Fix endless loop of codec configure Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:10 +0200
[PATCH 4.4 051/101] net: bgmac: Remove superflous netif_carrier_on() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:10 +0200
[PATCH 4.4 033/101] scsi: sd: Fix wrong DPOFUA disable in sd_read_cache_type Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:10 +0200
[PATCH 4.4 064/101] vfio/spapr: fail tce_iommu_attach_group() when iommu_data is null Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:10 +0200
[PATCH 4.4 068/101] kernel/panic.c: add missing \n Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:10 +0200
[PATCH 4.4 050/101] net: bgmac: Start transmit queue in bgmac_open Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:10 +0200
[PATCH 4.4 037/101] net: mvneta: Fix for_each_present_cpu usage Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:10 +0200
[PATCH 4.4 027/101] drm/vmwgfx: Free hash table allocated by cmdbuf managed res mgr Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:10 +0200
[PATCH 4.4 041/101] MIPS: ralink: fix USB frequency scaling Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:10 +0200
[PATCH 4.4 017/101] netfilter: xt_TCPMSS: add more sanity tests on tcph->doff Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:10 +0200
[PATCH 4.4 003/101] decnet: dn_rtmsg: Improve input length sanitization in dnrmg_receive_user_skb Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:20 +0200
[PATCH 4.4 021/101] mm, swap_cgroup: reschedule when neeed in swap_cgroup_swapoff() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:20 +0200
[PATCH 4.4 005/101] af_unix: Add sockaddr length checks before accessing sa_family in bind and connect handlers Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:20 +0200
[PATCH 4.4 002/101] net: dont call strlen on non-terminated string in dev_set_alias() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:20 +0200
[PATCH 4.4 006/101] Fix an intermittent pr_emerg warning about lo becoming free. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:20 +0200
[PATCH 4.4 004/101] net: Zero ifla_vf_info in rtnl_fill_vfinfo() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:20 +0200
[PATCH 4.4 011/101] net/mlx5: Wait for FW readiness before initializing command interface Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:20 +0200
[PATCH 4.4 020/101] drm/ast: Handle configuration without P2A bridge Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:20 +0200
[PATCH 4.4 007/101] net: caif: Fix a sleep-in-atomic bug in cfpkt_create_pfx Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-03 17:20 +0200
Re: [PATCH 4.4 000/101] 4.4.76-stable review Guenter Roeck <linux@roeck-us.net> - 2017-07-03 21:40 +0200
Re: [PATCH 4.4 000/101] 4.4.76-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-04 10:10 +0200
Re: [PATCH 4.4 000/101] 4.4.76-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-04 10:10 +0200
csiph-web