linux-kernel - Re: [PATCH 3/3] seccomp: introduce read protection for struct seccomp

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAG48ez2h51s1VG8hf1ASHHq88r5b+6rS4nSkgvre77jgsJLbhg@mail.gmail.com>
Date:   Fri, 28 Sep 2018 22:33:34 +0200
From:   Jann Horn <jannh@...gle.com>
To:     Tycho Andersen <tycho@...ho.ws>
Cc:     Kees Cook <keescook@...omium.org>,
        kernel list <linux-kernel@...r.kernel.org>,
        Andy Lutomirski <luto@...capital.net>
Subject: Re: [PATCH 3/3] seccomp: introduce read protection for struct seccomp

On Fri, Sep 28, 2018 at 5:47 PM Tycho Andersen <tycho@...ho.ws> wrote:
> As Jann pointed out, there is a race between SECCOMP_FILTER_FLAG_TSYNC and
> the ptrace code that can inspect a filter of another process. Let's
> introduce read locking into the two ptrace accesses so that we don't race.

Hmm. Is that true? The ptrace code uses get_nth_filter(), which holds
the siglock while grabbing the seccomp filter and bumping its
refcount. And TSYNC happens from seccomp_set_mode_filter(), which
takes the siglock. So this looks okay to me?

> Signed-off-by: Tycho Andersen <tycho@...ho.ws>
> Reported-by: Jann Horn <jannh@...gle.com>
> CC: Kees Cook <keescook@...omium.org>
> CC: Andy Lutomirski <luto@...capital.net>
> ---
>  include/linux/seccomp.h |  4 ++--
>  kernel/seccomp.c        | 10 ++++++++++
>  2 files changed, 12 insertions(+), 2 deletions(-)
>
> diff --git a/include/linux/seccomp.h b/include/linux/seccomp.h
> index 8429bdda947a..30b27e898162 100644
> --- a/include/linux/seccomp.h
> +++ b/include/linux/seccomp.h
> @@ -22,8 +22,8 @@ struct seccomp_filter;
>   * @filter: must always point to a valid seccomp-filter or NULL as it is
>   *          accessed without locking during system call entry.
>   *
> - *          @filter must only be accessed from the context of current as there
> - *          is no read locking.
> + *          @filter is read-protected by task->signal->cred_guard_mutex when
> + *          outside of current context.
>   */
>  struct seccomp {
>         int mode;
> diff --git a/kernel/seccomp.c b/kernel/seccomp.c
> index ef80dd19f268..f65d47650ac1 100644
> --- a/kernel/seccomp.c
> +++ b/kernel/seccomp.c
> @@ -1042,7 +1042,12 @@ int seccomp_get_filter(struct task_struct *task, unsigned long filter_off,
>                 return -EACCES;
>         }
>
> +       ret = mutex_lock_killable(&task->signal->cred_guard_mutex);
> +       if (ret < 0)
> +               return ret;
> +
>         filter = get_nth_filter(task, filter_off);
> +       mutex_unlock(&task->signal->cred_guard_mutex);
>         if (IS_ERR(filter))
>                 return PTR_ERR(filter);
>
> @@ -1088,7 +1093,12 @@ int seccomp_get_metadata(struct task_struct *task,
>         if (copy_from_user(&kmd.filter_off, data, sizeof(kmd.filter_off)))
>                 return -EFAULT;
>
> +       ret = mutex_lock_killable(&task->signal->cred_guard_mutex);
> +       if (ret < 0)
> +               return ret;
> +
>         filter = get_nth_filter(task, kmd.filter_off);
> +       mutex_unlock(&task->signal->cred_guard_mutex);
>         if (IS_ERR(filter))
>                 return PTR_ERR(filter);
>
> --
> 2.17.1
>