This new MAY_EXECMOUNT flag enables to check if the underlying mount
point of an inode is marked as executable. This is useful to implement
a security policy taking advantage of the noexec mount option.
This flag is set according to path_noexec(), which checks if a mount
point is mounted with MNT_NOEXEC or if the underlying superblock is
SB_I_NOEXEC.
Signed-off-by: Mickaël Salaün <[email protected]>
Reviewed-by: Philippe Trébuchet <[email protected]>
Reviewed-by: Thibaut Sautereau <[email protected]>
Cc: Aleksa Sarai <[email protected]>
Cc: Al Viro <[email protected]>
Cc: Kees Cook <[email protected]>
---
fs/namei.c | 2 ++
include/linux/fs.h | 2 ++
2 files changed, 4 insertions(+)
diff --git a/fs/namei.c b/fs/namei.c
index a320371899cf..33b6d372e74a 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -2849,6 +2849,8 @@ static int may_open(const struct path *path, int acc_mode, int flag)
break;
}
+ /* Pass the mount point executability. */
+ acc_mode |= path_noexec(path) ? 0 : MAY_EXECMOUNT;
error = inode_permission(inode, MAY_OPEN | acc_mode);
if (error)
return error;
diff --git a/include/linux/fs.h b/include/linux/fs.h
index 313c934de9ee..79435fca6c3e 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -103,6 +103,8 @@ typedef int (dio_iodone_t)(struct kiocb *iocb, loff_t offset,
#define MAY_NOT_BLOCK 0x00000080
/* the inode is opened with O_MAYEXEC */
#define MAY_OPENEXEC 0x00000100
+/* the mount point is marked as executable */
+#define MAY_EXECMOUNT 0x00000200
/*
* flags in file.f_mode. Note that FMODE_READ and FMODE_WRITE must correspond
--
2.26.2
On Tue, May 05, 2020 at 05:31:52PM +0200, Micka?l Sala?n wrote:
> This new MAY_EXECMOUNT flag enables to check if the underlying mount
> point of an inode is marked as executable. This is useful to implement
> a security policy taking advantage of the noexec mount option.
>
> This flag is set according to path_noexec(), which checks if a mount
> point is mounted with MNT_NOEXEC or if the underlying superblock is
> SB_I_NOEXEC.
>
> Signed-off-by: Micka?l Sala?n <[email protected]>
> Reviewed-by: Philippe Tr?buchet <[email protected]>
> Reviewed-by: Thibaut Sautereau <[email protected]>
> Cc: Aleksa Sarai <[email protected]>
> Cc: Al Viro <[email protected]>
> Cc: Kees Cook <[email protected]>
> ---
> fs/namei.c | 2 ++
> include/linux/fs.h | 2 ++
> 2 files changed, 4 insertions(+)
>
> diff --git a/fs/namei.c b/fs/namei.c
> index a320371899cf..33b6d372e74a 100644
> --- a/fs/namei.c
> +++ b/fs/namei.c
> @@ -2849,6 +2849,8 @@ static int may_open(const struct path *path, int acc_mode, int flag)
> break;
> }
>
> + /* Pass the mount point executability. */
> + acc_mode |= path_noexec(path) ? 0 : MAY_EXECMOUNT;
> error = inode_permission(inode, MAY_OPEN | acc_mode);
> if (error)
> return error;
> diff --git a/include/linux/fs.h b/include/linux/fs.h
> index 313c934de9ee..79435fca6c3e 100644
> --- a/include/linux/fs.h
> +++ b/include/linux/fs.h
> @@ -103,6 +103,8 @@ typedef int (dio_iodone_t)(struct kiocb *iocb, loff_t offset,
> #define MAY_NOT_BLOCK 0x00000080
> /* the inode is opened with O_MAYEXEC */
> #define MAY_OPENEXEC 0x00000100
> +/* the mount point is marked as executable */
> +#define MAY_EXECMOUNT 0x00000200
>
> /*
> * flags in file.f_mode. Note that FMODE_READ and FMODE_WRITE must correspond
I find this name unintuitive, but I cannot think of anything better,
since I think my problem is that "MAY" doesn't map to the language I
want to use to describe what this flag is indicating.
Reviewed-by: Kees Cook <[email protected]>
--
Kees Cook
On Wed, May 13, 2020 at 12:09 AM Kees Cook <[email protected]> wrote:
>
> On Tue, May 05, 2020 at 05:31:52PM +0200, Mickaël Salaün wrote:
> > This new MAY_EXECMOUNT flag enables to check if the underlying mount
> > point of an inode is marked as executable. This is useful to implement
> > a security policy taking advantage of the noexec mount option.
> >
Security policy is expressed by sysadmin by mount -noexec very clear,
I don't think there is a need
in sysctl, wish is system-wide
> > This flag is set according to path_noexec(), which checks if a mount
> > point is mounted with MNT_NOEXEC or if the underlying superblock is
> > SB_I_NOEXEC.
> >
> > Signed-off-by: Mickaël Salaün <[email protected]>
> > Reviewed-by: Philippe Trébuchet <[email protected]>
> > Reviewed-by: Thibaut Sautereau <[email protected]>
> > Cc: Aleksa Sarai <[email protected]>
> > Cc: Al Viro <[email protected]>
> > Cc: Kees Cook <[email protected]>
> > ---
> > fs/namei.c | 2 ++
> > include/linux/fs.h | 2 ++
> > 2 files changed, 4 insertions(+)
> >
> > diff --git a/fs/namei.c b/fs/namei.c
> > index a320371899cf..33b6d372e74a 100644
> > --- a/fs/namei.c
> > +++ b/fs/namei.c
> > @@ -2849,6 +2849,8 @@ static int may_open(const struct path *path, int acc_mode, int flag)
> > break;
> > }
> >
> > + /* Pass the mount point executability. */
> > + acc_mode |= path_noexec(path) ? 0 : MAY_EXECMOUNT;
> > error = inode_permission(inode, MAY_OPEN | acc_mode);
> > if (error)
> > return error;
> > diff --git a/include/linux/fs.h b/include/linux/fs.h
> > index 313c934de9ee..79435fca6c3e 100644
> > --- a/include/linux/fs.h
> > +++ b/include/linux/fs.h
> > @@ -103,6 +103,8 @@ typedef int (dio_iodone_t)(struct kiocb *iocb, loff_t offset,
> > #define MAY_NOT_BLOCK 0x00000080
> > /* the inode is opened with O_MAYEXEC */
> > #define MAY_OPENEXEC 0x00000100
> > +/* the mount point is marked as executable */
> > +#define MAY_EXECMOUNT 0x00000200
> >
> > /*
> > * flags in file.f_mode. Note that FMODE_READ and FMODE_WRITE must correspond
>
> I find this name unintuitive, but I cannot think of anything better,
> since I think my problem is that "MAY" doesn't map to the language I
> want to use to describe what this flag is indicating.
>
> Reviewed-by: Kees Cook <[email protected]>
>
> --
> Kees Cook
I think that the original patch was perfect, I quite it again
@@ -3167,6 +3167,14 @@ static int may_open(struct path *path, int
acc_mode, int flag)
+
+ if ((acc_mode & MAY_OPENEXEC)
+ && (S_ISREG(inode->i_mode) || S_ISDIR(inode->i_mode))
+ && (path->mnt && (path->mnt->mnt_flags & MNT_NOEXEC)))
+ return -EACCES;
+
+
+
error = inode_permission(inode, MAY_OPEN | acc_mode);
As I said in the inline comment above, sysadmin had already express
security policy in a very clear way,
mount -noexec !
I would only check inside inode_permission() whether the file mode is
any ---x permission and deny such
open when file is opened with O_MAYEXEC under MNT_NOEXEC mount point
New sysctl is indeed required to allow userspace that places scripts
or libs under noexec mounts.
fs.mnt_noexec_strict =0 (allow, e) , 1 (deny any file with --x
permission), 2 (deny when O_MAYEXEC absent), for any file with ---x
permissions)
On Thu, May 14, 2020 at 11:14:04AM +0300, Lev R. Oshvang . wrote:
> New sysctl is indeed required to allow userspace that places scripts
> or libs under noexec mounts.
But since this is a not-uncommon environment, we must have the sysctl
otherwise this change would break those systems.
> fs.mnt_noexec_strict =0 (allow, e) , 1 (deny any file with --x
> permission), 2 (deny when O_MAYEXEC absent), for any file with ---x
> permissions)
I don't think we want another mount option -- this is already fully
expressed with noexec and the system-wide sysctl.
--
Kees Cook
On Thu, May 14, 2020 at 6:48 PM Kees Cook <[email protected]> wrote:
>
> On Thu, May 14, 2020 at 11:14:04AM +0300, Lev R. Oshvang . wrote:
> > New sysctl is indeed required to allow userspace that places scripts
> > or libs under noexec mounts.
>
> But since this is a not-uncommon environment, we must have the sysctl
> otherwise this change would break those systems.
>
But I proposed sysctl on a line below.
> > fs.mnt_noexec_strict =1 (allow, e) , 1 (deny any file with --x
> > permission), 2 (deny when O_MAYEXEC absent), for any file with ---x
> > permissions)
>
> I don't think we want another mount option -- this is already fully
> expressed with noexec and the system-wide sysctl.
>
> --
The intended use of proposed sysctl is to ebable sysadmin to decide
whar is desired semantics mount with NO_EXEC option.
fs.mnt_noexec_scope =0 |1|2|3
0 - means old behaviour i.e do nor run executables and scripts (default)
1 - deny any file with --x permissions, i.e executables , script and libs
2 - deny any file when O_MAYEXEC is present.
I think this is enough to handle all use cases and to not break
current sysadmin file mounts setting
I oppose the new O_MAY_EXECMOUNT flag, kernel already has MNT_NO_EXEC,
SB_NOEXEC and SB_I_NOEXEC and I frankly do not understand why so many
variants exist.
Lev