[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <87pprck0q7.fsf@xmission.com>
Date: Thu, 10 Oct 2013 19:20:00 -0700
From: ebiederm@...ssion.com (Eric W. Biederman)
To: Joe Perches <joe@...ches.com>
Cc: Ryan Mallon <rmallon@...il.com>, Andrew Morton <akpm@...ux-foundation.org>, eldad@...refinery.com, Jiri Kosina <jkosina@...e.cz>, jgunthorpe@...idianresearch.com, Dan Rosenberg <dan.j.rosenberg@...il.com>, Kees Cook <keescook@...omium.org>, Alexander Viro <viro@...iv.linux.org.uk>, George Spelvin <linux@...izon.com>, "kernel-hardening\@lists.openwall.com" <kernel-hardening@...ts.openwall.com>, "linux-kernel\@vger.kernel.org" <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH v3a] vsprintf: Check real user/group id for %pK
Joe Perches <joe@...ches.com> writes:
> Some setuid binaries will allow reading of files which have read
> permission by the real user id. This is problematic with files which
> use %pK because the file access permission is checked at open() time,
> but the kptr_restrict setting is checked at read() time. If a setuid
> binary opens a %pK file as an unprivileged user, and then elevates
> permissions before reading the file, then kernel pointer values may be
> leaked.
>
> This happens for example with the setuid pppd application on Ubuntu
> 12.04:
>
> $ head -1 /proc/kallsyms
> 00000000 T startup_32
>
> $ pppd file /proc/kallsyms
> pppd: In file /proc/kallsyms: unrecognized option 'c1000000'
>
> This will only leak the pointer value from the first line, but other
> setuid binaries may leak more information.
>
> Fix this by adding a check that in addition to the current process
> having CAP_SYSLOG, that effective user and group ids are equal to the
> real ids. If a setuid binary reads the contents of a file which uses
> %pK then the pointer values will be printed as NULL if the real user
> is unprivileged.
>
> Update the sysctl documentation to reflect the changes, and also
> correct the documentation to state the kptr_restrict=0 is the default.
Sigh. This is all wrong. The only correct thing to test is
file->f_cred. Aka the capabilities of the program that opened the
file.
Which means that the interface to %pK in the case of kptr_restrict is
broken as it has no way to be passed the information it needs to make
a sensible decision.
So if you all are going to make a great big fuss and clutter up my inbox
can you please figure out how to implement kptr_restrict in a non-buggy
way?
Thank you.
Eric
> Original-patch-by: Ryan Mallon <rmallon@...il.com>
> Signed-off-by: Joe Perches <joe@...ches.com>
> ---
> On Thu, 2013-10-10 at 09:42 +1100, Ryan Mallon wrote:
>> If it was noisy, it would indicate a bunch of broken kernel code which
>> needs fixing :-).
>
> Or maybe a single kernel source line but
> you'd still have a filled up log file.
>
> Changes in V3a:
>
> Do the in_irq tests only when kptr_restrict is 1.
> Document the %pK mechanism in vsnprintf
> Add missing documentation for %pV and %pNF too
>
> Documentation/sysctl/kernel.txt | 17 ++++++++--------
> lib/vsprintf.c | 43 ++++++++++++++++++++++++++++-------------
> 2 files changed, 39 insertions(+), 21 deletions(-)
>
> diff --git a/Documentation/sysctl/kernel.txt b/Documentation/sysctl/kernel.txt
> index 9d4c1d1..c17d5ca 100644
> --- a/Documentation/sysctl/kernel.txt
> +++ b/Documentation/sysctl/kernel.txt
> @@ -289,14 +289,15 @@ Default value is "/sbin/hotplug".
>
> kptr_restrict:
>
> -This toggle indicates whether restrictions are placed on
> -exposing kernel addresses via /proc and other interfaces. When
> -kptr_restrict is set to (0), there are no restrictions. When
> -kptr_restrict is set to (1), the default, kernel pointers
> -printed using the %pK format specifier will be replaced with 0's
> -unless the user has CAP_SYSLOG. When kptr_restrict is set to
> -(2), kernel pointers printed using %pK will be replaced with 0's
> -regardless of privileges.
> +This toggle indicates whether restrictions are placed on exposing kernel
> +addresses via /proc and other interfaces.
> +
> +When kptr_restrict is set to (0), the default, there are no restrictions.
> +When kptr_restrict is set to (1), kernel pointers printed using the %pK
> +format specifier will be replaced with 0's unless the user has CAP_SYSLOG
> +and effective user and group ids are equal to the real ids.
> +When kptr_restrict is set to (2), kernel pointers printed using %pK will
> +be replaced with 0's regardless of privileges.
>
> ==============================================================
>
> diff --git a/lib/vsprintf.c b/lib/vsprintf.c
> index 26559bd..3efcf29 100644
> --- a/lib/vsprintf.c
> +++ b/lib/vsprintf.c
> @@ -27,6 +27,7 @@
> #include <linux/uaccess.h>
> #include <linux/ioport.h>
> #include <linux/dcache.h>
> +#include <linux/cred.h>
> #include <net/addrconf.h>
>
> #include <asm/page.h> /* for PAGE_SIZE */
> @@ -1301,21 +1302,34 @@ char *pointer(const char *fmt, char *buf, char *end, void *ptr,
> va_end(va);
> return buf;
> }
> - case 'K':
> - /*
> - * %pK cannot be used in IRQ context because its test
> - * for CAP_SYSLOG would be meaningless.
> - */
> - if (kptr_restrict && (in_irq() || in_serving_softirq() ||
> - in_nmi())) {
> - if (spec.field_width == -1)
> - spec.field_width = default_width;
> - return string(buf, end, "pK-error", spec);
> + case 'K': /* see: Documentation/sysctl/kernel.txt */
> + switch (kptr_restrict) {
> + case 0: /* None (default) */
> + break;
> + case 1: { /* Restricted */
> + const struct cred *cred;
> +
> + if (in_irq() || in_serving_softirq() || in_nmi()) {
> + /*
> + * This cannot be used in IRQ context because
> + * the test for CAP_SYSLOG would be meaningless
> + */
> + if (spec.field_width == -1)
> + spec.field_width = default_width;
> + return string(buf, end, "pK-error", spec);
> + }
> + cred = current_cred();
> + if (!has_capability_noaudit(current, CAP_SYSLOG) ||
> + !uid_eq(cred->euid, cred->uid) ||
> + !gid_eq(cred->egid, cred->gid))
> + ptr = NULL;
> + break;
> }
> - if (!((kptr_restrict == 0) ||
> - (kptr_restrict == 1 &&
> - has_capability_noaudit(current, CAP_SYSLOG))))
> + case 2: /* Never - Always emit 0 */
> + default:
> ptr = NULL;
> + break;
> + }
> break;
> case 'N':
> switch (fmt[1]) {
> @@ -1574,6 +1588,9 @@ qualifier:
> * %piS depending on sa_family of 'struct sockaddr *' print IPv4/IPv6 address
> * %pU[bBlL] print a UUID/GUID in big or little endian using lower or upper
> * case.
> + * %pV recurse and output a struct va_format (const char *fmt, va_list *)
> + * %pK output a kernel address or 0 depending on sysctl kptr_restrict
> + * %pNF output a netdev_features_t
> * %*ph[CDN] a variable-length hex string with a separator (supports up to 64
> * bytes of the input)
> * %n is ignored
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
