Received: by 10.223.185.116 with SMTP id b49csp3927779wrg; Tue, 13 Feb 2018 09:53:38 -0800 (PST) X-Google-Smtp-Source: AH8x225LuF+xef/JWcYXWXABTEp5RvDbt7bcEvE2ud3XPsxnaVFMHkhLxaTKMKdSsJC3hXfmEA6l X-Received: by 2002:a17:902:8e8a:: with SMTP id bg10-v6mr1877502plb.162.1518544418616; Tue, 13 Feb 2018 09:53:38 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1518544418; cv=none; d=google.com; s=arc-20160816; b=HdsfKGa/8WYcOYhueYNaJcQ0w5NUvW9ecPDrWJ64LMAz3/6wzs2VXA+VahMoRZXFxF G5fAtY+OpYC3oq8V6FhUwGuBkp5FVnXo7OzAEhp6X8qGiwEhRYacOxCI3W0/3ZMMSfKT lovDTZoAR+swUM2lKZf2fb9qSsW+bLXaGV3kMv1P1tu8v803orwPKqcNeFXuO1WVQfzl WUNfnKAjRGwwfRiDrICnW1mmfJ6ER0uhN7w3v3ptknHH1crZ4W7co1t4AFlK2ZOo6gyN Ii+moQVljzwAcig6OOksavKRzdNOeXR8rppxS4DoMB5lLpX5eLFVpFbmJc7sJBfm3Yhz JDaA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:references:in-reply-to:message-id:date :subject:cc:to:from:arc-authentication-results; bh=xenf7Z+Tv6ow4oGOJEAk0e04CViHUZOvOBZqrOOmKXk=; b=K9YgZ/Vtq7HB0MWbdgRGhng58Yp05y/MqhV3Ox0ukDLg1+HWnegZZblXleHd8c0Bix WpayE8TGM6gvBj854DKcm5Qfw/lDk9uuk9mIYkdFL0JqNYgNpR8SB6Du4EXOPHCNK1Ft AtESXUXVYDjgVqGvLqKUNy82D0Lclve/zcMWpUQ5ti5pQlM4LVdmMlxYII/iPFdbjep7 ZbswtWjNeZ+o2F/FT1tnAWVmLU9YrmX4OGn99/ySANkP13TVZLdBe8QtZ/wQ3KHG22Om aksmrYbK6pBvPIfYUMF/7d24YAzSW0eHegqsewv1rLap0x4U4vugJFpULMIZwQQYatmJ juaw== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id z127si1399257pgb.74.2018.02.13.09.53.23; Tue, 13 Feb 2018 09:53:38 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S965557AbeBMRvL (ORCPT + 99 others); Tue, 13 Feb 2018 12:51:11 -0500 Received: from smtp2.provo.novell.com ([137.65.250.81]:33953 "EHLO smtp2.provo.novell.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S965411AbeBMRvI (ORCPT ); Tue, 13 Feb 2018 12:51:08 -0500 Received: from linux-n805.suse.de (prv-ext-foundry1int.gns.novell.com [137.65.251.240]) by smtp2.provo.novell.com with ESMTP (TLS encrypted); Tue, 13 Feb 2018 10:51:01 -0700 From: Davidlohr Bueso To: akpm@linux-foundation.org Cc: mhocko@kernel.org, mtk.manpages@gmail.com, keescook@chromium.org, linux-api@vger.kernel.org, linux-kernel@vger.kernel.org, Davidlohr Bueso , Davidlohr Bueso Subject: [PATCH 2/3] ipc/sem: introduce shmctl(SEM_STAT_ALL) Date: Tue, 13 Feb 2018 09:41:35 -0800 Message-Id: <20180213174136.6346-3-dave@stgolabs.net> X-Mailer: git-send-email 2.13.6 In-Reply-To: <20180213174136.6346-1-dave@stgolabs.net> References: <20180213174136.6346-1-dave@stgolabs.net> Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org There is a permission discrepancy when consulting shm ipc object metadata between /proc/sysvipc/sem (0444) and the SEM_STAT semctl command. The later does permission checks for the object vs S_IRUGO. As such there can be cases where EACCESS is returned via syscall but the info is displayed anyways in the procfs files. While this might have security implications via info leaking (albeit no writing to the sma metadata), this behavior goes way back and showing all the objects regardless of the permissions was most likely an overlook - so we are stuck with it. Furthermore, modifying either the syscall or the procfs file can cause userspace programs to break (ie ipcs). Some applications require getting the procfs info (without root privileges) and can be rather slow in comparison with a syscall -- up to 500x in some reported cases for shm. This patch introduces a new SEM_STAT_ALL command such that the sem ipc object permissions are ignored, and only audited instead. In addition, I've left the lsm security hook checks in place, as if some policy can block the call, then the user has no other choice than just parsing the procfs file. Signed-off-by: Davidlohr Bueso --- include/uapi/linux/sem.h | 1 + ipc/sem.c | 17 ++++++++++++----- security/selinux/hooks.c | 1 + 3 files changed, 14 insertions(+), 5 deletions(-) diff --git a/include/uapi/linux/sem.h b/include/uapi/linux/sem.h index 9c3e745b0656..fde93f635660 100644 --- a/include/uapi/linux/sem.h +++ b/include/uapi/linux/sem.h @@ -19,6 +19,7 @@ /* ipcs ctl cmds */ #define SEM_STAT 18 #define SEM_INFO 19 +#define SEM_STAT_ALL 20 /* Obsolete, used only for backwards compatibility and libc5 compiles */ struct semid_ds { diff --git a/ipc/sem.c b/ipc/sem.c index a4af04979fd2..cb2737c7f1d6 100644 --- a/ipc/sem.c +++ b/ipc/sem.c @@ -1190,14 +1190,14 @@ static int semctl_stat(struct ipc_namespace *ns, int semid, memset(semid64, 0, sizeof(*semid64)); rcu_read_lock(); - if (cmd == SEM_STAT) { + if (cmd == SEM_STAT || cmd == SEM_STAT_ALL) { sma = sem_obtain_object(ns, semid); if (IS_ERR(sma)) { err = PTR_ERR(sma); goto out_unlock; } id = sma->sem_perm.id; - } else { + } else { /* IPC_STAT */ sma = sem_obtain_object_check(ns, semid); if (IS_ERR(sma)) { err = PTR_ERR(sma); @@ -1205,9 +1205,14 @@ static int semctl_stat(struct ipc_namespace *ns, int semid, } } - err = -EACCES; - if (ipcperms(ns, &sma->sem_perm, S_IRUGO)) - goto out_unlock; + /* see comment for SHM_STAT_ALL */ + if (cmd == SEM_STAT_ALL) + audit_ipc_obj(&sma->sem_perm); + else { + err = -EACCES; + if (ipcperms(ns, &sma->sem_perm, S_IRUGO)) + goto out_unlock; + } err = security_sem_semctl(sma, cmd); if (err) @@ -1596,6 +1601,7 @@ SYSCALL_DEFINE4(semctl, int, semid, int, semnum, int, cmd, unsigned long, arg) return semctl_info(ns, semid, cmd, p); case IPC_STAT: case SEM_STAT: + case SEM_STAT_ALL: err = semctl_stat(ns, semid, cmd, &semid64); if (err < 0) return err; @@ -1697,6 +1703,7 @@ COMPAT_SYSCALL_DEFINE4(semctl, int, semid, int, semnum, int, cmd, int, arg) return semctl_info(ns, semid, cmd, p); case IPC_STAT: case SEM_STAT: + case SEM_STAT_ALL: err = semctl_stat(ns, semid, cmd, &semid64); if (err < 0) return err; diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index dc2a9a0f6ddf..aa965742bba9 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -5847,6 +5847,7 @@ static int selinux_sem_semctl(struct sem_array *sma, int cmd) break; case IPC_STAT: case SEM_STAT: + case SEM_STAT_ALL: perms = SEM__GETATTR | SEM__ASSOCIATE; break; default: -- 2.13.6