linux-kernel - [PATCH 12/16] binfmt_elf: Do not mark process signed if binary has elf interpreter

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <1378849471-10521-13-git-send-email-vgoyal@redhat.com>
Date:	Tue, 10 Sep 2013 17:44:27 -0400
From:	Vivek Goyal <vgoyal@...hat.com>
To:	linux-kernel@...r.kernel.org,
	linux-security-module@...r.kernel.org, kexec@...ts.infradead.org
Cc:	akpm@...ux-foundation.org, zohar@...ux.vnet.ibm.com,
	d.kasatkin@...sung.com, ebiederm@...ssion.com, hpa@...or.com,
	matthew.garrett@...ula.com, vgoyal@...hat.com
Subject: [PATCH 12/16] binfmt_elf: Do not mark process signed if binary has elf interpreter

Currently one can write to shared libraries while these are mapped.
That means shared library code can not be trusted as after signature
verification, one can overwrite the code.

Till we find a way to take care of that issue, do not mark a process
signed if it has interpreter which in turn will load shared librareis.

This does not take care of application doing dlopen(). Just that be
careful while signing applications and don't sign anything which does
dlopen().

Signed-off-by: Vivek Goyal <vgoyal@...hat.com>
---
 fs/binfmt_elf.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
index 8f2286e..52f8bd2 100644
--- a/fs/binfmt_elf.c
+++ b/fs/binfmt_elf.c
@@ -995,8 +995,16 @@ static int load_elf_binary(struct linux_binprm *bprm)
 		 * not signed, do not set proc_signed, otherwise unsigned
 		 * tracer could change signed tracee's address space,
 		 * effectively nullifying singature checking.
+		 *
+		 * Also set proc_signed only if there is no elf interpreter.
+		 * We don't have a way to avoid writes to shared libraries
+		 * after they have been mapped. That means anybody can
+		 * write to library after signature verification. So don't
+		 * trust executables which are dynamically linked. This
+		 * does not cover dlopen() and friends. So don't sign
+		 * applications using dlopen().
 		 */
-		if (!ptraced_by_unsafe_tracer())
+		if (!ptraced_by_unsafe_tracer() && !elf_interpreter)
 			bprm->cred->proc_signed = true;
 	}
 #endif
-- 
1.8.3.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/