lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Thu, 04 Aug 2011 17:38:43 -0700 From: Casey Schaufler <casey@...aufler-ca.com> To: Anton Blanchard <anton@...ba.org> CC: penguin-kernel@...ove.SAKURA.ne.jp, davem@...emloft.net, eparis@...isplace.org, mjt@....msk.ru, netdev@...r.kernel.org, linux-security-module@...r.kernel.org, Casey Schaufler <casey@...aufler-ca.com> Subject: Re: [PATCH 3/3] net: Fix security_socket_sendmsg() bypass problem. On 8/4/2011 5:07 PM, Anton Blanchard wrote: > From: Tetsuo Handa <penguin-kernel@...ove.SAKURA.ne.jp> > > The sendmmsg() introduced by commit 228e548e "net: Add sendmmsg socket system > call" is capable of sending to multiple different destination addresses. > > SMACK is using destination's address for checking sendmsg() permission. > However, security_socket_sendmsg() is called for only once even if multiple > different destination addresses are passed to sendmmsg(). > > Therefore, we need to call security_socket_sendmsg() for each destination > address rather than only the first destination address. > > Since calling security_socket_sendmsg() every time when only single destination > address was passed to sendmmsg() is a waste of time, omit calling > security_socket_sendmsg() unless destination address of previous datagram and > that of current datagram differs. Thank you. > > Signed-off-by: Tetsuo Handa <penguin-kernel@...ove.SAKURA.ne.jp> > Acked-off: Anton Blanchard <anton@...ba.org> > Cc: stable <stable@...nel.org> [3.0+] > --- > > Index: linux-net/net/socket.c > =================================================================== > --- linux-net.orig/net/socket.c 2011-08-05 09:31:27.000000000 +1000 > +++ linux-net/net/socket.c 2011-08-05 09:32:46.146436405 +1000 > @@ -1871,8 +1871,14 @@ SYSCALL_DEFINE2(shutdown, int, fd, int, > #define COMPAT_NAMELEN(msg) COMPAT_MSG(msg, msg_namelen) > #define COMPAT_FLAGS(msg) COMPAT_MSG(msg, msg_flags) > > +struct used_address { > + struct sockaddr_storage name; > + unsigned int name_len; > +}; > + > static int __sys_sendmsg(struct socket *sock, struct msghdr __user *msg, > - struct msghdr *msg_sys, unsigned flags, int nosec) > + struct msghdr *msg_sys, unsigned flags, > + struct used_address *used_address) > { > struct compat_msghdr __user *msg_compat = > (struct compat_msghdr __user *)msg; > @@ -1953,8 +1959,28 @@ static int __sys_sendmsg(struct socket * > > if (sock->file->f_flags & O_NONBLOCK) > msg_sys->msg_flags |= MSG_DONTWAIT; > - err = (nosec ? sock_sendmsg_nosec : sock_sendmsg)(sock, msg_sys, > - total_len); > + /* > + * If this is sendmmsg() and current destination address is same as > + * previously succeeded address, omit asking LSM's decision. > + * used_address->name_len is initialized to UINT_MAX so that the first > + * destination address never matches. > + */ > + if (used_address && used_address->name_len == msg_sys->msg_namelen && > + !memcmp(&used_address->name, msg->msg_name, > + used_address->name_len)) { > + err = sock_sendmsg_nosec(sock, msg_sys, total_len); > + goto out_freectl; > + } > + err = sock_sendmsg(sock, msg_sys, total_len); > + /* > + * If this is sendmmsg() and sending to current destination address was > + * successful, remember it. > + */ > + if (used_address && err >= 0) { > + used_address->name_len = msg_sys->msg_namelen; > + memcpy(&used_address->name, msg->msg_name, > + used_address->name_len); > + } > > out_freectl: > if (ctl_buf != ctl) > @@ -1979,7 +2005,7 @@ SYSCALL_DEFINE3(sendmsg, int, fd, struct > if (!sock) > goto out; > > - err = __sys_sendmsg(sock, msg, &msg_sys, flags, 0); > + err = __sys_sendmsg(sock, msg, &msg_sys, flags, NULL); > > fput_light(sock->file, fput_needed); > out: > @@ -1998,6 +2024,7 @@ int __sys_sendmmsg(int fd, struct mmsghd > struct mmsghdr __user *entry; > struct compat_mmsghdr __user *compat_entry; > struct msghdr msg_sys; > + struct used_address used_address; > > if (vlen > UIO_MAXIOV) > vlen = UIO_MAXIOV; > @@ -2008,24 +2035,22 @@ int __sys_sendmmsg(int fd, struct mmsghd > if (!sock) > return err; > > + used_address.name_len = UINT_MAX; > entry = mmsg; > compat_entry = (struct compat_mmsghdr __user *)mmsg; > err = 0; > > while (datagrams < vlen) { > - /* > - * No need to ask LSM for more than the first datagram. > - */ > if (MSG_CMSG_COMPAT & flags) { > err = __sys_sendmsg(sock, (struct msghdr __user *)compat_entry, > - &msg_sys, flags, datagrams); > + &msg_sys, flags, &used_address); > if (err < 0) > break; > err = __put_user(err, &compat_entry->msg_len); > ++compat_entry; > } else { > err = __sys_sendmsg(sock, (struct msghdr __user *)entry, > - &msg_sys, flags, datagrams); > + &msg_sys, flags, &used_address); > if (err < 0) > break; > err = put_user(err, &entry->msg_len); > > > -- > To unsubscribe from this list: send the line "unsubscribe linux-security-module" in > the body of a message to majordomo@...r.kernel.org > More majordomo info at http://vger.kernel.org/majordomo-info.html > -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Powered by blists - more mailing lists