| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-Id: <1376497898-18619-3-git-send-email-zach@zachsthings.com>
Date: Wed, 14 Aug 2013 09:31:37 -0700
From: Zach Levis <zach@...hsthings.com>
To: akpm@...ux-foundation.org, oleg@...hat.com
Cc: viro@...iv.linux.org.uk, linux-kernel@...r.kernel.org,
linux-fsdevel@...r.kernel.org, dan.carpenter@...cle.com,
keescook@...omium.org, cody@...ux.vnet.ibm.com,
zml@...ux.vnet.ibm.com, Zach Levis <zach@...hsthings.com>
Subject: [PATCH v4 2/3] fs/binfmts: Better handling of binfmt loops
With these changes, when a binfmt loop is encountered,
the ELOOP will propogate back to the 0 depth. At this point the
argv and argc values will be reset to what they were originally and an
attempt is made to continue with the following binfmt handlers.
Example: a qemu is configured to run 64-bit ELFs on an otherwise 32-bit
system. The system's owner switches to running with 64-bit executables,
but forgets to disable the binfmt_misc option that redirects 64bit ELFs
to qemu. Since the qemu executable is a 64-bit ELF now, binfmt_misc
keeps on matching it with the qemu rule, preventing the execution of any
64-bit binary.
With these changes, an error is printed and search_binary_handler()
continues on to the next handler, allowing the original executable to
run normally so the user can (hopefully) fix their misconfiguration more
easily.
Caveats:
- binfmt_misc is skipped as a whole. To allow for a more generic
solution that works for any binfmt without a lot of duplicated code
and added complexity, the error detection code is applied on the
binfmt level.
- This is a fallback solution. It attempts to restore the state to allow
executing most binaries without side effects, but it may not work for
everything and should not be depended on for regular usage.
My (rough, but functional) test scripts for this issue are available at:
https://gist.github.com/zml2008/6075418
Signed-off-by: Zach Levis <zach@...hsthings.com>
---
fs/exec.c | 192 ++++++++++++++++++++++++++++++++++-------------
include/linux/binfmts.h | 5 +
2 files changed, 144 insertions(+), 53 deletions(-)
diff --git a/fs/exec.c b/fs/exec.c
index eb229e1..474222a 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -1365,6 +1365,107 @@ out:
}
EXPORT_SYMBOL(remove_arg_zero);
+static void bprm_close_file(struct linux_binprm *bprm)
+{
+ if (bprm->mm) {
+ acct_arg_size(bprm, 0);
+ mmput(bprm->mm);
+ }
+
+ if (bprm->file) {
+ allow_write_access(bprm->file);
+ fput(bprm->file);
+ }
+}
+
+static int init_bprm(struct linux_binprm *bprm,
+ const char *filename,
+ struct user_arg_ptr *argv,
+ struct user_arg_ptr *envp)
+{
+ int retval;
+ struct file *file;
+
+ file = open_exec(filename);
+ retval = PTR_ERR(file);
+ if (IS_ERR(file))
+ return retval;
+
+ if (!bprm->file)
+ sched_exec();
+
+ bprm->file = file;
+ bprm->filename = filename;
+ bprm->interp = filename;
+
+ retval = bprm_mm_init(bprm);
+ if (retval)
+ goto err;
+
+ retval = bprm->argc = count(*argv, MAX_ARG_STRINGS);
+ if (retval < 0)
+ goto err;
+
+ retval = bprm->envc = count(*envp, MAX_ARG_STRINGS);
+ if (retval < 0)
+ goto err;
+
+ retval = prepare_binprm(bprm);
+ if (retval < 0)
+ goto err;
+
+ retval = copy_strings_kernel(1, &bprm->filename, bprm);
+ if (retval < 0)
+ goto err;
+
+ bprm->argv_orig = argv;
+ bprm->envp_orig = envp;
+ bprm->exec = bprm->p;
+ retval = copy_strings(bprm->envc, *envp, bprm);
+ if (retval < 0)
+ goto err;
+
+ retval = copy_strings(bprm->argc, *argv, bprm);
+ if (retval < 0)
+ goto err;
+
+out:
+ return retval;
+err:
+ bprm_close_file(bprm);
+ goto out;
+}
+
+
+static bool update_prev_binfmts(struct linux_binprm *bprm,
+ struct linux_binfmt *cur_fmt)
+{
+
+ if (!try_module_get(cur_fmt->module))
+ return false;
+ if (bprm->previous_binfmts[1])
+ put_binfmt(bprm->previous_binfmts[1]);
+ bprm->previous_binfmts[1] = bprm->previous_binfmts[0];
+ bprm->previous_binfmts[0] = cur_fmt;
+ return true;
+}
+
+static void put_binfmts(struct linux_binprm *bprm, struct linux_binfmt *cur_fmt)
+{
+ if (bprm->previous_binfmts[1])
+ put_binfmt(bprm->previous_binfmts[1]);
+ if (bprm->previous_binfmts[0])
+ put_binfmt(bprm->previous_binfmts[0]);
+ if (cur_fmt)
+ put_binfmt(cur_fmt);
+}
+
+/* Get name null-safely */
+static inline const char *binfmt_name(struct linux_binfmt *fmt)
+{
+ return fmt ? fmt->name : "NULL";
+}
+
#define printable(c) (((c)=='\t') || ((c)=='\n') || (0x20<=(c) && (c)<=0x7e))
/*
* cycle the list of binary formats handler, until one recognizes the image
@@ -1393,18 +1494,44 @@ int search_binary_handler(struct linux_binprm *bprm)
list_for_each_entry(fmt, &formats, lh) {
if (!try_module_get(fmt->module))
continue;
+
+ if (!update_prev_binfmts(bprm, fmt))
+ continue;
+
read_unlock(&binfmt_lock);
+
bprm->recursion_depth++;
retval = fmt->load_binary(bprm);
bprm->recursion_depth--;
- if (retval >= 0 || retval != -ENOEXEC ||
- bprm->mm == NULL || bprm->file == NULL) {
- put_binfmt(fmt);
+ if (retval == -ELOOP
+ && bprm->recursion_depth == 0) { /* cur, previous */
+ pr_err("Too much recursion with binfmts (0:%s, -1:%s) in file %s, skipping (base %s).\n",
+ binfmt_name(bprm->previous_binfmts[0]),
+ binfmt_name(bprm->previous_binfmts[1]),
+ bprm->filename,
+ fmt->name);
+
+ free_arg_pages(bprm);
+ if (bprm->interp != bprm->filename)
+ kfree(bprm->interp);
+ bprm_close_file(bprm);
+ retval = init_bprm(bprm, bprm->filename,
+ bprm->argv_orig, bprm->envp_orig);
+ if (retval < 0) {
+ put_binfmts(bprm, fmt);
+ return retval;
+ }
+
+ } else if (retval >= 0 || retval != -ENOEXEC ||
+ bprm->mm == NULL || bprm->file == NULL) {
+ put_binfmts(bprm, fmt);
return retval;
}
+
read_lock(&binfmt_lock);
put_binfmt(fmt);
}
+ put_binfmts(bprm, NULL);
read_unlock(&binfmt_lock);
if (need_retry && retval == -ENOEXEC) {
@@ -1436,6 +1563,11 @@ static int exec_binprm(struct linux_binprm *bprm)
if (ret >= 0) {
trace_sched_process_exec(current, old_pid, bprm);
ptrace_event(PTRACE_EVENT_EXEC, old_vpid);
+ /* Successful execution, now null out the cached argv
+ * (we don't want to access it later)
+ * */
+ bprm->argv_orig = NULL;
+ bprm->envp_orig = NULL;
current->did_exec = 1;
proc_exec_connector(current);
@@ -1448,6 +1580,7 @@ static int exec_binprm(struct linux_binprm *bprm)
return ret;
}
+
/*
* sys_execve() executes a new program.
*/
@@ -1456,7 +1589,6 @@ static int do_execve_common(const char *filename,
struct user_arg_ptr envp)
{
struct linux_binprm *bprm;
- struct file *file;
struct files_struct *displaced;
bool clear_in_exec;
int retval;
@@ -1497,45 +1629,9 @@ static int do_execve_common(const char *filename,
clear_in_exec = retval;
current->in_execve = 1;
- file = open_exec(filename);
- retval = PTR_ERR(file);
- if (IS_ERR(file))
- goto out_unmark;
-
- sched_exec();
-
- bprm->file = file;
- bprm->filename = filename;
- bprm->interp = filename;
-
- retval = bprm_mm_init(bprm);
- if (retval)
- goto out_file;
-
- bprm->argc = count(argv, MAX_ARG_STRINGS);
- if ((retval = bprm->argc) < 0)
- goto out;
-
- bprm->envc = count(envp, MAX_ARG_STRINGS);
- if ((retval = bprm->envc) < 0)
- goto out;
-
- retval = prepare_binprm(bprm);
+ retval = init_bprm(bprm, filename, &argv, &envp);
if (retval < 0)
- goto out;
-
- retval = copy_strings_kernel(1, &bprm->filename, bprm);
- if (retval < 0)
- goto out;
-
- bprm->exec = bprm->p;
- retval = copy_strings(bprm->envc, envp, bprm);
- if (retval < 0)
- goto out;
-
- retval = copy_strings(bprm->argc, argv, bprm);
- if (retval < 0)
- goto out;
+ goto out_unmark;
retval = exec_binprm(bprm);
if (retval < 0)
@@ -1551,17 +1647,7 @@ static int do_execve_common(const char *filename,
return retval;
out:
- if (bprm->mm) {
- acct_arg_size(bprm, 0);
- mmput(bprm->mm);
- }
-
-out_file:
- if (bprm->file) {
- allow_write_access(bprm->file);
- fput(bprm->file);
- }
-
+ bprm_close_file(bprm);
out_unmark:
if (clear_in_exec)
current->fs->in_exec = 0;
diff --git a/include/linux/binfmts.h b/include/linux/binfmts.h
index 402a74a..3451db8 100644
--- a/include/linux/binfmts.h
+++ b/include/linux/binfmts.h
@@ -8,6 +8,8 @@
#define CORENAME_MAX_SIZE 128
+struct user_arg_ptr; /* Struct from fs/exec.c, for linux_binprm->argv_orig */
+
/*
* This structure is used to hold the arguments that are used when loading binaries.
*/
@@ -32,11 +34,14 @@ struct linux_binprm {
unsigned int taso:1;
#endif
unsigned int recursion_depth;
+ /* current binfmt at 0 and previous binfmt at 1 */
+ struct linux_binfmt *previous_binfmts[2];
struct file * file;
struct cred *cred; /* new credentials */
int unsafe; /* how unsafe this exec is (mask of LSM_UNSAFE_*) */
unsigned int per_clear; /* bits to clear in current->personality */
int argc, envc;
+ struct user_arg_ptr *argv_orig, *envp_orig;
const char * filename; /* Name of binary as seen by procps */
const char * interp; /* Name of the binary really executed. Most
of the time same as filename, but could be
--
1.7.1
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists