| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <5359177E.1070907@gmx.de>
Date: Thu, 24 Apr 2014 15:54:06 +0200
From: Heinrich Schuchardt <xypron.glpk@....de>
To: Jan Kara <jack@...e.cz>,
"Michael Kerrisk (man-pages)" <mtk.manpages@...il.com>
CC: Eric Paris <eparis@...hat.com>, lkml <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH 1/1] fanotify: check permissions when creating file descriptor
On 24.04.2014 11:04, Jan Kara wrote:
> On Tue 22-04-14 16:07:47, Jan Kara wrote:
>> On Tue 22-04-14 15:50:26, Michael Kerrisk (man-pages) wrote:
>>> On Tue, Apr 22, 2014 at 3:40 PM, Jan Kara <jack@...e.cz> wrote:
>>>> On Sat 19-04-14 22:53:53, Heinrich Schuchardt wrote:
>>>>> When monitoring a directory or a mount with the fanotify API
>>>>> the call to fanotify_init checks,
>>>>> * the process has cap_sys_admin capability
>>>>>
>>>>> The call to fanotify_mark checks,
>>>>> * the process has read authorization for directory or mount
>>>>>
>>>>> A directory or mount may contain files for which the process
>>>>> has no read or write authorization.
>>>>> Yet when reading from the fanotify file descriptor, structures
>>>>> fanotify_event_metadata are returned, which contain a file
>>>>> descriptor for these files, and will allow to read or write.
>>>>>
>>>>> The patch adds an authorization check for read and write
>>>>> permission. In case of missing permission, reading from the
>>>>> fanotify file descriptor returns EACCES.
>>>> OK, am I right you are concerned about a situation where fanotify group
>>>> descriptor is passed to an unpriviledged process which handles all the
>>>> incoming events? I'm asking because the permission checking can be
>>>> relatively expensive (think of acls) so we better do it for a reason.
>>>> I'd prefer to hear from Eric what the original intention regarding
>>>> permissions was...
>>>
>>> If I understand correctly, passing to an unprivileged process is the
>>> point. The point is I think that supposedly one only needs to
>>> CAP_SYS_ADMIN to use fanotify. However, once you have that capability,
>>> then you implicitly get the effect of CAP_DAC_READ_SEARCH and
>>> CAP_DAC_OVERRIDE as well.
>> Ah, OK. Thanks for explanation. Then I'm OK with the patch. So feel free
>> to add:
>>
>> Reviewed-by: Jan Kara <jack@...e.cz>
> Hum, when digging more around this code, I've found out that
> fanotify_mark() checks whether it has a read permission to a watched file
> when creating the mark (in fanotify_find_path()). So I don't think it's
> really worth it to recheck the permissions when creating a file .gnupg/secring.gpgdescriptor
> for the event. Sure it may be somewhat surprising that read fd is created
> after a process doesn't have access to the file anymore but OTOH it is
> similar to a situation where the process has opened the file long time ago.
>
fanotify_mark checks for the read authorization for the marked object,
not for the object for which the event occurs.
This means a listener may have read authorization for /home and mark
this mount.
Afterwards, while you sign a git tag, it will receive a FAN_OPEN event
and use the file descriptor supplied in the event to overwrite your
/home/jankara/.gnupg/secring.pgp
though the file is chmod 600 and the listener is neither root nor you.
>
>>>>> fs/notify/fanotify/fanotify_user.c | 20 +++++++++++++++-----
>>>>> 1 file changed, 15 insertions(+), 5 deletions(-)
>>>>>
>>>>> diff --git a/fs/notify/fanotify/fanotify_user.c b/fs/notify/fanotify/fanotify_user.c
>>>>> index 4e565c8..5d22a20 100644
>>>>> --- a/fs/notify/fanotify/fanotify_user.c
>>>>> +++ b/fs/notify/fanotify/fanotify_user.c
>>>>> @@ -62,6 +62,8 @@ static int create_fd(struct fsnotify_group *group,
>>>>> {
>>>>> int client_fd;
>>>>> struct file *new_file;
>>>>> + int mask;
>>>>> + int ret;
>>>>>
>>>>> pr_debug("%s: group=%p event=%p\n", __func__, group, event);
>>>>>
>>>>> @@ -75,11 +77,19 @@ static int create_fd(struct fsnotify_group *group,
>>>>> */
>>>>> /* it's possible this event was an overflow event. in that case dentry and mnt
>>>>> * are NULL; That's fine, just don't call dentry open */
>>>>> - if (event->path.dentry && event->path.mnt)
>>>>> - new_file = dentry_open(&event->path,
>>>>> - group->fanotify_data.f_flags | FMODE_NONOTIFY,
>>>>> - current_cred());
>>>>> - else
>>>>> + if (event->path.dentry && event->path.mnt) {
>>>>> + /* check permissions before granting access to file */
>>>>> + mask = MAY_READ;
>>>>> + if (group->fanotify_data.f_flags & (O_RDWR | O_WRONLY))
>>>>> + mask |= MAY_WRITE;
>>>>> + ret = inode_permission(event->path.dentry->d_inode, mask);
>>>>> + if (ret)
>>>>> + new_file = ERR_PTR(ret);
>>>>> + else
>>>>> + new_file = dentry_open(&event->path,
>>>>> + group->fanotify_data.f_flags | FMODE_NONOTIFY,
>>>>> + current_cred());
>>>>> + } else
>>>>> new_file = ERR_PTR(-EOVERFLOW);
>>>>> if (IS_ERR(new_file)) {
>>>>> /*
>>>>> --
>>>>> 1.9.1
>>>>>
>>>> --
>>>> Jan Kara <jack@...e.cz>
>>>> SUSE Labs, CR
>>>
>>>
>>>
>>> --
>>> Michael Kerrisk
>>> Linux man-pages maintainer; http://www.kernel.org/doc/man-pages/
>>> Linux/UNIX System Programming Training: http://man7.org/training/
>> --
>> Jan Kara <jack@...e.cz>
>> SUSE Labs, CR
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists