linux-kernel - Re: [PATCH] introduce kernel_execve function to replace __KERNEL_SYSCALLS_

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <200608211712.17780.arnd@arndb.de>
Date:	Mon, 21 Aug 2006 17:12:17 +0200
From:	Arnd Bergmann <arnd@...db.de>
To:	Paul Mackerras <paulus@...ba.org>
Cc:	Björn Steinbrink <B.Steinbrink@....de>,
	Russell King <rmk+lkml@....linux.org.uk>,
	Andrew Morton <akpm@...l.org>, rusty@...tcorp.com.au,
	linux-kernel@...r.kernel.org, linux-arch@...r.kernel.org
Subject: Re: [PATCH] introduce kernel_execve function to replace __KERNEL_SYSCALLS__

On Monday 21 August 2006 02:36, Paul Mackerras wrote:
> > Iit turned out most of the architectures that already implement
> > their own execve() call instead of using the _syscall3 function
> > for it end up passing the return value of sys_execve down, 
> > instead of setting errno.
> 
> I really don't like having an "errno" variable in the kernel.  What if
> two processes are doing an execve concurrently?

The point is that we have two different schemes in the kernel that
conflict:

alpha, arm{,26}, ia64, parisc, powerpc and x86_64 pass the error
code from execve, all others pass -1 and set the global errno.

So the caller does not really have a chance to get the correct error
value at all. Bjoern's first patch changed one caller from looking
at the return value to looking at errno in case of an error, which
shifts the problem to other architectures.

My patch makes the errno variable local to execve, which slightly
helps, and makes it easier to get it right completely right
by doing the same as powerpc or parisc.

Now, we could do a truely evil involving a nested function, like

#include <asm/bug.h>
#include <asm/uaccess.h>
#define __KERNEL_SYSCALLS__
#include <linux/unistd.h>
int kernel_execve(const char *filename, char *const argv[], char *const envp[])
{
	mm_segment_t fs = get_fs();
	int errno;
	int ret;
	_syscall3(int,execve,const char *,file,char *const*,argv,char *const*,envp)
	WARN_ON(segment_eq(fs, USER_DS));
	ret = execve(filename, argv, envp);
	if (ret)
		ret = -errno;
	return ret;
}

That would solve the problem of races on the errno variable,
but set a bad example to other hackers.

> Anyway, your patch returns the (positive) errno value here:
> 
> > +     WARN_ON(segment_eq(fs, USER_DS));
> > +     ret = execve(filename, (char **)argv, (char **)envp);
> > +     if (ret)
> > +             ret = errno;
> > +
> > +     return ret;
> 
> but here we are testing for a negative value to mean error:
> 
> > -     if (execve("/sbin/shutdown", argv, envp) < 0) {
> > +     if (kernel_execve("/sbin/shutdown", argv, envp) < 0) {

Yes, Chase Venters already noticed that bug. If obviously needs
to be 'ret = -errno;'.

	Arnd <><
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/