Skip to content

Commit 378c652

Browse files
thejhtorvalds
thejh
authored and
torvalds
committed
fs/coredump: prevent fsuid=0 dumps into user-controlled directories
This commit fixes the following security hole affecting systems where all of the following conditions are fulfilled: - The fs.suid_dumpable sysctl is set to 2. - The kernel.core_pattern sysctl's value starts with "/". (Systems where kernel.core_pattern starts with "|/" are not affected.) - Unprivileged user namespace creation is permitted. (This is true on Linux >=3.8, but some distributions disallow it by default using a distro patch.) Under these conditions, if a program executes under secure exec rules, causing it to run with the SUID_DUMP_ROOT flag, then unshares its user namespace, changes its root directory and crashes, the coredump will be written using fsuid=0 and a path derived from kernel.core_pattern - but this path is interpreted relative to the root directory of the process, allowing the attacker to control where a coredump will be written with root privileges. To fix the security issue, always interpret core_pattern for dumps that are written under SUID_DUMP_ROOT relative to the root directory of init. Signed-off-by: Jann Horn <jann@thejh.net> Acked-by: Kees Cook <keescook@chromium.org> Cc: Al Viro <viro@zeniv.linux.org.uk> Cc: "Eric W. Biederman" <ebiederm@xmission.com> Cc: Andy Lutomirski <luto@kernel.org> Cc: Oleg Nesterov <oleg@redhat.com> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
1 parent 1333ab0 commit 378c652

File tree

6 files changed

+32
-12
lines changed

6 files changed

+32
-12
lines changed

‎arch/um/drivers/mconsole_kern.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -133,7 +133,7 @@ void mconsole_proc(struct mc_request *req)
133133
ptr += strlen("proc");
134134
ptr = skip_spaces(ptr);
135135

136-
file = file_open_root(mnt->mnt_root, mnt, ptr, O_RDONLY);
136+
file = file_open_root(mnt->mnt_root, mnt, ptr, O_RDONLY, 0);
137137
if (IS_ERR(file)) {
138138
mconsole_reply(req, "Failed to open file", 1, 0);
139139
printk(KERN_ERR "open /proc/%s: %ld\n", ptr, PTR_ERR(file));

‎fs/coredump.c‎

Lines changed: 26 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,9 @@
3232
#include <linux/pipe_fs_i.h>
3333
#include <linux/oom.h>
3434
#include <linux/compat.h>
35+
#include <linux/sched.h>
36+
#include <linux/fs.h>
37+
#include <linux/path.h>
3538
#include <linux/timekeeping.h>
3639

3740
#include <asm/uaccess.h>
@@ -649,6 +652,8 @@ void do_coredump(const siginfo_t *siginfo)
649652
}
650653
} else {
651654
struct inode *inode;
655+
int open_flags = O_CREAT | O_RDWR | O_NOFOLLOW |
656+
O_LARGEFILE | O_EXCL;
652657

653658
if (cprm.limit < binfmt->min_coredump)
654659
goto fail_unlock;
@@ -687,10 +692,27 @@ void do_coredump(const siginfo_t *siginfo)
687692
* what matters is that at least one of the two processes
688693
* writes its coredump successfully, not which one.
689694
*/
690-
cprm.file = filp_open(cn.corename,
691-
O_CREAT | 2 | O_NOFOLLOW |
692-
O_LARGEFILE | O_EXCL,
693-
0600);
695+
if (need_suid_safe) {
696+
/*
697+
* Using user namespaces, normal user tasks can change
698+
* their current->fs->root to point to arbitrary
699+
* directories. Since the intention of the "only dump
700+
* with a fully qualified path" rule is to control where
701+
* coredumps may be placed using root privileges,
702+
* current->fs->root must not be used. Instead, use the
703+
* root directory of init_task.
704+
*/
705+
struct path root;
706+
707+
task_lock(&init_task);
708+
get_fs_root(init_task.fs, &root);
709+
task_unlock(&init_task);
710+
cprm.file = file_open_root(root.dentry, root.mnt,
711+
cn.corename, open_flags, 0600);
712+
path_put(&root);
713+
} else {
714+
cprm.file = filp_open(cn.corename, open_flags, 0600);
715+
}
694716
if (IS_ERR(cprm.file))
695717
goto fail_unlock;
696718

‎fs/fhandle.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -228,7 +228,7 @@ long do_handle_open(int mountdirfd,
228228
path_put(&path);
229229
return fd;
230230
}
231-
file = file_open_root(path.dentry, path.mnt, "", open_flag);
231+
file = file_open_root(path.dentry, path.mnt, "", open_flag, 0);
232232
if (IS_ERR(file)) {
233233
put_unused_fd(fd);
234234
retval = PTR_ERR(file);

‎fs/open.c‎

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -992,14 +992,12 @@ struct file *filp_open(const char *filename, int flags, umode_t mode)
992992
EXPORT_SYMBOL(filp_open);
993993

994994
struct file *file_open_root(struct dentry *dentry, struct vfsmount *mnt,
995-
const char *filename, int flags)
995+
const char *filename, int flags, umode_t mode)
996996
{
997997
struct open_flags op;
998-
int err = build_open_flags(flags, 0, &op);
998+
int err = build_open_flags(flags, mode, &op);
999999
if (err)
10001000
return ERR_PTR(err);
1001-
if (flags & O_CREAT)
1002-
return ERR_PTR(-EINVAL);
10031001
return do_file_open_root(dentry, mnt, filename, &op);
10041002
}
10051003
EXPORT_SYMBOL(file_open_root);

‎include/linux/fs.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2263,7 +2263,7 @@ extern long do_sys_open(int dfd, const char __user *filename, int flags,
22632263
extern struct file *file_open_name(struct filename *, int, umode_t);
22642264
extern struct file *filp_open(const char *, int, umode_t);
22652265
extern struct file *file_open_root(struct dentry *, struct vfsmount *,
2266-
const char *, int);
2266+
const char *, int, umode_t);
22672267
extern struct file * dentry_open(const struct path *, int, const struct cred *);
22682268
extern int filp_close(struct file *, fl_owner_t id);
22692269

‎kernel/sysctl_binary.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1321,7 +1321,7 @@ static ssize_t binary_sysctl(const int *name, int nlen,
13211321
}
13221322

13231323
mnt = task_active_pid_ns(current)->proc_mnt;
1324-
file = file_open_root(mnt->mnt_root, mnt, pathname, flags);
1324+
file = file_open_root(mnt->mnt_root, mnt, pathname, flags, 0);
13251325
result = PTR_ERR(file);
13261326
if (IS_ERR(file))
13271327
goto out_putname;

0 commit comments

Comments
 (0)