linux-kernel - Re: [PATCH v3 09/15] exec: Correct comments about "point of no return"

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <874lu9b6f3.fsf@xmission.com>
Date:   Tue, 18 Jul 2017 19:45:52 -0500
From:   ebiederm@...ssion.com (Eric W. Biederman)
To:     Kees Cook <keescook@...omium.org>
Cc:     Andrew Morton <akpm@...ux-foundation.org>,
        David Howells <dhowells@...hat.com>,
        John Johansen <john.johansen@...onical.com>,
        "Serge E. Hallyn" <serge@...lyn.com>,
        Paul Moore <paul@...l-moore.com>,
        Stephen Smalley <sds@...ho.nsa.gov>,
        Casey Schaufler <casey@...aufler-ca.com>,
        Tetsuo Handa <penguin-kernel@...ove.SAKURA.ne.jp>,
        James Morris <james.l.morris@...cle.com>,
        Andy Lutomirski <luto@...nel.org>,
        Linus Torvalds <torvalds@...ux-foundation.org>,
        linux-fsdevel@...r.kernel.org,
        linux-security-module@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH v3 09/15] exec: Correct comments about "point of no return"

Kees Cook <keescook@...omium.org> writes:

> In commit 221af7f87b97 ("Split 'flush_old_exec' into two functions"),
> the comment about the point of no return should have stayed in
> flush_old_exec() since it refers to "bprm->mm = NULL;" line, but prior
> changes in commits c89681ed7d0e ("remove steal_locks()"), and
> fd8328be874f ("sanitize handling of shared descriptor tables in failing
> execve()") made it look like it meant the current->sas_ss_sp line instead.
>
> The comment was referring to the fact that once bprm->mm is NULL, all
> failures from a binfmt load_binary hook (e.g. load_elf_binary), will
> get SEGV raised against current. Move this comment and expand the
> explanation a bit, putting it above the assignment this time, and add
> details about the true nature of "point of no return" being the call
> to flush_old_exec() itself.
>
> This also removes an erroneous commet about when credentials are being
> installed. That has its own dedicated function, install_exec_creds(),
> which carries a similar (and correct) comment, so remove the bogus comment
> where installation is not actually happening.

Acked-by: "Eric W. Biederman" <ebiederm@...ssion.com>

>
> Cc: David Howells <dhowells@...hat.com>
> Cc: Eric W. Biederman <ebiederm@...ssion.com>
> Signed-off-by: Kees Cook <keescook@...omium.org>
> ---
>  fs/exec.c | 16 +++++++++++++---
>  1 file changed, 13 insertions(+), 3 deletions(-)
>
> diff --git a/fs/exec.c b/fs/exec.c
> index 53ffa739fb58..f9480d3e0b82 100644
> --- a/fs/exec.c
> +++ b/fs/exec.c
> @@ -1258,6 +1258,12 @@ void __set_task_comm(struct task_struct *tsk, const char *buf, bool exec)
>  	perf_event_comm(tsk, exec);
>  }
>  
> +/*
> + * Calling this is the point of no return. None of the failures will be
> + * seen by userspace since either the process is already taking a fatal
> + * signal (via de_thread() or coredump), or will have SEGV raised
> + * (after exec_mmap()) by search_binary_handlers (see below).
> + */
>  int flush_old_exec(struct linux_binprm * bprm)
>  {
>  	int retval;
> @@ -1285,7 +1291,13 @@ int flush_old_exec(struct linux_binprm * bprm)
>  	if (retval)
>  		goto out;
>  
> -	bprm->mm = NULL;		/* We're using it now */
> +	/*
> +	 * After clearing bprm->mm (to mark that current is using the
> +	 * prepared mm now), we have nothing left of the original
> +	 * process. If anything from here on returns an error, the check
> +	 * in search_binary_handler() will SEGV current.
> +	 */
> +	bprm->mm = NULL;
>  
>  	set_fs(USER_DS);
>  	current->flags &= ~(PF_RANDOMIZE | PF_FORKNOEXEC | PF_KTHREAD |
> @@ -1339,7 +1351,6 @@ void setup_new_exec(struct linux_binprm * bprm)
>  
>  	arch_pick_mmap_layout(current->mm);
>  
> -	/* This is the point of no return */
>  	current->sas_ss_sp = current->sas_ss_size = 0;
>  
>  	if (uid_eq(current_euid(), current_uid()) && gid_eq(current_egid(), current_gid()))
> @@ -1357,7 +1368,6 @@ void setup_new_exec(struct linux_binprm * bprm)
>  	 */
>  	current->mm->task_size = TASK_SIZE;
>  
> -	/* install the new credentials */
>  	if (!uid_eq(bprm->cred->uid, current_euid()) ||
>  	    !gid_eq(bprm->cred->gid, current_egid())) {
>  		current->pdeath_signal = 0;