linux-kernel - [PATCH 11/19] Check if the process is an ELF executable

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20131004103157.1612.78311.stgit@f19-x64>
Date:	Fri, 04 Oct 2013 16:01:58 +0530
From:	Janani Venkataraman <jananive@...ibm.com>
To:	linux-kernel@...r.kernel.org
Cc:	amwang@...hat.com, rdunlap@...otime.net, andi@...stfloor.org,
	aravinda@...ux.vnet.ibm.com, hch@....de, mhiramat@...hat.com,
	jeremy.fitzhardinge@...rix.com, xemul@...allels.com,
	suzuki@...ux.vnet.ibm.com, kosaki.motohiro@...fujitsu.com,
	adobriyan@...il.com, tarundsk@...ux.vnet.ibm.com,
	vapier@...too.org, roland@...k.frob.com, tj@...nel.org,
	ananth@...ux.vnet.ibm.com, gorcunov@...nvz.org, avagin@...nvz.org,
	oleg@...hat.com, eparis@...hat.com, d.hatayama@...fujitsu.com,
	james.hogan@...tec.com, akpm@...ux-foundation.org,
	torvalds@...ux-foundation.org
Subject: [PATCH 11/19] Check if the process is an ELF executable

From:Suzuki K. Poulose <suzuki@...ibm.com>

Validate if the process is an ELF exec. This will be later extended to identify
if the task is a native ELF or a compat ELF.

Signed-off-by: Suzuki K. Poulose <suzuki@...ibm.com>
---
 fs/proc/gencore.c |   29 +++++++++++++++++++++++++++++
 1 file changed, 29 insertions(+)

diff --git a/fs/proc/gencore.c b/fs/proc/gencore.c
index 580a8b5..5f56910 100644
--- a/fs/proc/gencore.c
+++ b/fs/proc/gencore.c
@@ -22,6 +22,7 @@
  *      Suzuki K. Poulose <suzuki@...ibm.com>
  */
 
+#include <linux/elf.h>
 #include <linux/seq_file.h>
 #include <linux/slab.h>
 #include "internal.h"
@@ -85,6 +86,29 @@ static int release_gencore(struct inode *inode, struct file *file)
 	return 0;
 }
 
+ /*
+ * Determine whether the task is an ELF executable.
+ * Returns
+ *     < 0     - Non-ELF
+ *     0       - Native ELF Executable
+ */
+static int get_elf_class(struct task_struct *task)
+{
+	struct elfhdr hdr;
+	int ret = 0;
+	ret = kernel_read(task->mm->exe_file, 0, (char*)&hdr, sizeof(hdr));
+	if (ret < 0)
+		return ret;
+	
+	/* Verify the ELF magic on the exe_file */
+	if (memcmp(hdr.e_ident, ELFMAG, SELFMAG))
+		return -EINVAL;
+	if (elf_check_arch(&hdr))
+		return 0;
+	
+	return -EINVAL;
+}
+
 /*
  * Validate if the call is valid. We also need to prevent >1 open
  * of the same file.
@@ -93,10 +117,15 @@ static int open_gencore(struct inode *inode, struct file *filp)
 {
 	struct task_struct *task = get_proc_task(inode);
 	struct core_proc *cp;
+	int elf_class;
 	int ret = 0;
 	if (!task)
 		return -ENOENT;
 
+	elf_class = get_elf_class(task);
+	if (elf_class < 0)
+		return elf_class;
+
 	mutex_lock(&core_mutex);
 	cp = get_core_proc(task);
 	mutex_unlock(&core_mutex);	

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/