linux-kernel - [PATCH] file capabilities: don't prevent signaling setuid root programs.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20071126180028.GA9106@sergelap.austin.ibm.com>
Date:	Mon, 26 Nov 2007 12:00:28 -0600
From:	"Serge E. Hallyn" <serue@...ibm.com>
To:	lkml <linux-kernel@...r.kernel.org>
Cc:	Linus Torvalds <torvalds@...l.org>, Andrew Morton <akpm@...l.org>,
	linux-security-module@...r.kernel.org,
	Andrew Morgan <morgan@...nel.org>,
	Stephen Smalley <sds@...ch.ncsc.mil>,
	Chris Wright <chrisw@...s-sol.org>, chris@...edhoff.org
Subject: [PATCH] file capabilities: don't prevent signaling setuid root
	programs.

This patch is needed to preserve legacy behavior when
CONFIG_SECURITY_FILE_CAPABILITIES=y.  Without this patch, xinit can't
kill X, so manually starting X in runlevel 3 then exiting your window
manager will not cause X to exit. 

thanks,
-serge

>From 81a6d780ad570f9a326fc27912ec0e373f5fa14f Mon Sep 17 00:00:00 2001
From: Serge E. Hallyn <serue@...ibm.com>
Date: Tue, 20 Nov 2007 08:47:35 +0000
Subject: [PATCH] file capabilities: don't prevent signaling setuid root programs.

An unprivileged process must be able to kill a setuid root
program started by the same user.  This is legacy behavior
needed for instance for xinit to kill X when the window manager
exits.

When an unprivileged user runs a setuid root program in !SECURE_NOROOT
mode, fP, fI, and fE are set full on, so pP' and pE' are full on.
Then cap_task_kill() prevents the user from signaling the setuid root
task.  This is a change in behavior compared to when
!CONFIG_SECURITY_FILE_CAPABILITIES.

This patch introduces a special check into cap_task_kill() just
to check whether a non-root user is signaling a setuid root
program started by the same user.  If so, then signal is allowed.

Changelog:
	Nov 26: move test up above CAP_KILL test as per Andrew
		Morgan's suggestion.

Signed-off-by: Serge E. Hallyn <serue@...ibm.com>
---
 security/commoncap.c |    9 +++++++++
 1 files changed, 9 insertions(+), 0 deletions(-)

diff --git a/security/commoncap.c b/security/commoncap.c
index 302e8d0..5bc1895 100644
--- a/security/commoncap.c
+++ b/security/commoncap.c
@@ -526,6 +526,15 @@ int cap_task_kill(struct task_struct *p, struct siginfo *info,
 	if (info != SEND_SIG_NOINFO && (is_si_special(info) || SI_FROMKERNEL(info)))
 		return 0;

+	/*
+	 * Running a setuid root program raises your capabilities.
+	 * Killing your own setuid root processes was previously
+	 * allowed.
+	 * We must preserve legacy signal behavior in this case.
+	 */
+	if (p->euid == 0 && p->uid == current->uid)
+		return 0;
+
 	/* sigcont is permitted within same session */
 	if (sig == SIGCONT && (task_session_nr(current) == task_session_nr(p)))
 		return 0;
-- 
1.5.2.5

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/