linux-kernel - Re: [PATCH] umh: fix memory leak on execve failure

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20200413154925.GA18663@criteo.com>
Date:   Mon, 13 Apr 2020 17:49:25 +0200
From:   Vincent Minet <v.minet@...teo.com>
To:     linux-kernel@...r.kernel.org
Cc:     Luis Chamberlain <mcgrof@...nel.org>,
        Alexei Starovoitov <ast@...nel.org>,
        Kentaro Takeda <takedakn@...data.co.jp>,
        Tetsuo Handa <penguin-kernel@...ove.sakura.ne.jp>,
        Vincent Minet <v.minet@...teo.com>
Subject: Re: [PATCH] umh: fix memory leak on execve failure

In my case, execve fails with ENOENT on a Tomoyo enabled kernel. It doesn't seem
like CONFIG_BPFILTER and CONFIG_SECURITY_TOMOYO are compatible as it is.

The UMH is executed via "do_execve_file", so we'll have bprm->filename set to
"none". This causes the following call chain to fail and search_binary_handler()
to return ENOENT.
  search_binary_handler() ->
  security_bprm_check() ->
  tomoyo_bprm_check_security() ->
  tomoyo_find_next_domain() ->
  tomoyo_realpath_nofollow()

I don't really know how to solve this. As I understand it, you really need
a "valid" pathname for Tomoyo and it's not obvious what that should be for the
user-mode blob.

-- 
Vincent Minet