linux-kernel - [PATCH 1/9] procfs: use flags to deny or allow access to /proc/<pid>/$entry

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <1401110850-3552-2-git-send-email-tixxdz@opendz.org>
Date:	Mon, 26 May 2014 14:27:22 +0100
From:	Djalal Harouni <tixxdz@...ndz.org>
To:	Kees Cook <keescook@...omium.org>,
	Andrew Morton <akpm@...ux-foundation.org>,
	Alexey Dobriyan <adobriyan@...il.com>,
	"Eric W. Biederman" <ebiederm@...ssion.com>,
	Al Viro <viro@...iv.linux.org.uk>,
	Linus Torvalds <torvalds@...ux-foundation.org>,
	Ingo Molnar <mingo@...nel.org>,
	Oleg Nesterov <oleg@...hat.com>,
	Peter Zijlstra <peterz@...radead.org>,
	Andy Lutomirski <luto@...capital.net>
Cc:	LKML <linux-kernel@...r.kernel.org>, linux-fsdevel@...r.kernel.org,
	Djalal Harouni <tixxdz@...ndz.org>
Subject: [PATCH 1/9] procfs: use flags to deny or allow access to /proc/<pid>/$entry

Add the deny or allow flags, so we can perform proper permission checks
and set the result accordingly. These flags are needed in case we have
to cache the result of permission checks that are done during ->open()
time. Later during ->read(), we can decide to allow or deny the read().

The pid entries that need these flags are:
/proc/<pid>/stat
/proc/<pid>/wchan
/proc/<pid>/maps  (will be handled in next patches).

These files are world readable, userspace depend on that. To prevent
ASLR leaks and to avoid breaking userspace, we follow this scheme:

a) Perform permission checks during ->open()
b) Cache the result of a) and return success
c) Recheck the cached result during ->read()
d) If cached == PID_ENTRY_DENY:
   then we replace the sensitive fields with zeros, userspace won't
   break and sensitive fields are protected.

These flags are internal to /proc/<pid>/*

Signed-off-by: Djalal Harouni <tixxdz@...ndz.org>
---
 fs/proc/internal.h | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/fs/proc/internal.h b/fs/proc/internal.h
index 3ab6d14..e696284 100644
--- a/fs/proc/internal.h
+++ b/fs/proc/internal.h
@@ -19,6 +19,15 @@ struct ctl_table_header;
 struct mempolicy;

 /*
+ * Flags used to deny or allow current to access /proc/<pid>/$entry
+ * after proper permission checks.
+ */
+enum {
+	PID_ENTRY_DENY	= 0,	/* Deny access */
+	PID_ENTRY_ALLOW	= 1,	/* Allow access */
+};
+
+/*
  * This is not completely implemented yet. The idea is to
  * create an in-memory tree (like the actual /proc filesystem
  * tree) of these proc_dir_entries, so that we can dynamically
-- 
1.7.11.7

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/