Received: by 10.223.185.116 with SMTP id b49csp1074482wrg; Sat, 3 Mar 2018 14:51:02 -0800 (PST) X-Google-Smtp-Source: AG47ELuTYsSZcSE6d8Y0T26JnFaM4G0ZUbdJjsDEZFfe/mb4rmG9Xu0tUsGnoXP88xj8W3Fgr0NQ X-Received: by 10.99.114.65 with SMTP id c1mr8547664pgn.314.1520117462111; Sat, 03 Mar 2018 14:51:02 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1520117462; cv=none; d=google.com; s=arc-20160816; b=MY1Hg1vFlxZ/DrNEUqWdHdPkDIkM5e8LyGWbtavFJM256dUM18oqhPifsrYDOFhL4D gyvx9lIuC+xvnhpzpe5r45Sm8mghEyzIm4BZ7Yv4G52LMvurCJgTnpm+DdHzcm40aZp8 Y8N13FP7SehgYrW/iTHUmeICQElNvXa9t76wtkV+aPcnP5liu+n+bT0tgWma9pRp59gA d8eMCTFbp4G2YFgWBzw3ayulBZ68Rq8TyLKPL5y8ztSyJ2dkJsTen5GOpRbiJR1u6wNU XwacmQpJRocblBh8Br0ULiAmVr3PUdRNEfZOdL1eV1c1NVB0FOjWDsWGgzOqQfUTM96g GUWA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:mime-version:content-transfer-encoding :spamdiagnosticmetadata:spamdiagnosticoutput:content-language :accept-language:in-reply-to:references:message-id:date:thread-index :thread-topic:subject:cc:to:from:dkim-signature :arc-authentication-results; bh=WZu5yMM2m9qAcetTzxTuKcHU6h+N1WtCny3/X6CRY3w=; b=zHwchxKG6Jxht8pNn3zmpJnyYdMMgjDMxk7qbYvrfi7QL7aRasn4s8eF480b37/G65 ID0gGq0v+yBtR/1krBsc1g68dhiZE3nGHgTTf0/lGx35fV8mIJWVkVgIEeT9037pqZXZ KT55uyDnZ9JpbrTfUqaKLpMpIrvPpRzaDhx7tq6USW0/GPwIT3a5jPfh5LFGgu4R9vyj M+Nam01WXsb0DZu5i4JW1sKTx+ihDV5HFaGrYcewohVM7QMfdS4CLOMAU3BpN9bMcV5e AMKhKa70jKYi8/LUl05MjY00JfmpIRalyxEz7c9U3K3MHV/5mRp2OBoHaXRG5nvkW+WA HyAg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@microsoft.com header.s=selector1 header.b=bSCVzMxj; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=microsoft.com Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id h1-v6si6815664pld.16.2018.03.03.14.50.47; Sat, 03 Mar 2018 14:51:02 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@microsoft.com header.s=selector1 header.b=bSCVzMxj; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=microsoft.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S935286AbeCCWtv (ORCPT + 99 others); Sat, 3 Mar 2018 17:49:51 -0500 Received: from mail-by2nam01on0129.outbound.protection.outlook.com ([104.47.34.129]:5824 "EHLO NAM01-BY2-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S932629AbeCCWlo (ORCPT ); Sat, 3 Mar 2018 17:41:44 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=WZu5yMM2m9qAcetTzxTuKcHU6h+N1WtCny3/X6CRY3w=; b=bSCVzMxj+VKMaawb3t7c4r+A0EaTMyuxTS4jHCKa5/7E5GHA3rSiHMmzLqTeeEbmzkJvw0t/zUkSvXmffj+nTZRfMFYFWFpjDcHj6b5F9foDJQI1/oNhDtdrY+UBadGdlDLVzrjK1o1VHFnTfRq+RQpbg1VLZ4HNnIpSvebM4QE= Received: from MW2PR2101MB1034.namprd21.prod.outlook.com (52.132.149.10) by MW2SPR01MB06.namprd21.prod.outlook.com (52.132.152.33) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.567.3; Sat, 3 Mar 2018 22:41:42 +0000 Received: from MW2PR2101MB1034.namprd21.prod.outlook.com ([fe80::1d56:338f:e2b:cec0]) by MW2PR2101MB1034.namprd21.prod.outlook.com ([fe80::1d56:338f:e2b:cec0%3]) with mapi id 15.20.0567.006; Sat, 3 Mar 2018 22:41:42 +0000 From: Sasha Levin To: "linux-kernel@vger.kernel.org" , "stable@vger.kernel.org" CC: John Johansen , James Morris , Sasha Levin Subject: [PATCH AUTOSEL for 3.18 32/63] apparmor: Make path_max parameter readonly Thread-Topic: [PATCH AUTOSEL for 3.18 32/63] apparmor: Make path_max parameter readonly Thread-Index: AQHTsz+n7rt2lb5U7k2iQPmiOFD26g== Date: Sat, 3 Mar 2018 22:33:29 +0000 Message-ID: <20180303223228.27323-32-alexander.levin@microsoft.com> References: <20180303223228.27323-1-alexander.levin@microsoft.com> In-Reply-To: <20180303223228.27323-1-alexander.levin@microsoft.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [52.168.54.252] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1;MW2SPR01MB06;7:Klx0sj2eHbxjACIdIX0yVsb7065QaDp5TRMrcch0bxyq/fULpPC5F8zlYYFUOpgETM3CV3UKHu9HR4fb5I8jyhbhem7VY0i7/qaZR0jC8bJxPMzH2arOMz4k7zEC9Z2hhhO/7mBODf+EGXEzWTlBez8iW8AsSYzKHxdtnXFSUxpc0GVD+JcCEzeeVqDcDVhltVAaSe2BSdd3CugUpNmhuC7Ekq/1T84c6EQJ2+us6vLQTYR5pOK/gmT0pPWsGBT5 x-ms-office365-filtering-ht: Tenant x-ms-office365-filtering-correlation-id: 4e1c0db7-1756-4d8e-f171-08d58157ef5d x-microsoft-antispam: UriScan:;BCL:0;PCL:0;RULEID:(7020095)(4652020)(4534165)(4627221)(201703031133081)(201702281549075)(48565401081)(5600026)(4604075)(3008032)(2017052603307)(7193020);SRVR:MW2SPR01MB06; x-ms-traffictypediagnostic: MW2SPR01MB06: authentication-results: spf=none (sender IP is ) smtp.mailfrom=Alexander.Levin@microsoft.com; x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(28532068793085)(274141268393343)(89211679590171)(192374486261705)(146099531331640)(198206253151910); x-exchange-antispam-report-cfa-test: BCL:0;PCL:0;RULEID:(8211001083)(61425038)(6040501)(2401047)(5005006)(8121501046)(3002001)(10201501046)(93006095)(93001095)(3231220)(944501244)(52105095)(6055026)(61426038)(61427038)(6041288)(20161123562045)(20161123560045)(20161123558120)(201703131423095)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(20161123564045)(6072148)(201708071742011);SRVR:MW2SPR01MB06;BCL:0;PCL:0;RULEID:;SRVR:MW2SPR01MB06; x-forefront-prvs: 0600F93FE1 x-forefront-antispam-report: SFV:NSPM;SFS:(10019020)(346002)(396003)(39860400002)(39380400002)(366004)(376002)(189003)(199004)(3660700001)(8936002)(72206003)(5660300001)(14454004)(110136005)(6512007)(4326008)(6506007)(26005)(2501003)(66066001)(86362001)(7736002)(54906003)(305945005)(25786009)(10290500003)(53936002)(6436002)(2906002)(81156014)(59450400001)(8676002)(478600001)(102836004)(106356001)(316002)(186003)(5250100002)(81166006)(6486002)(76176011)(86612001)(6666003)(2900100001)(3846002)(68736007)(97736004)(36756003)(1076002)(107886003)(2950100002)(105586002)(99286004)(6116002)(3280700002)(22452003)(10090500001)(22906009)(217873001);DIR:OUT;SFP:1102;SCL:1;SRVR:MW2SPR01MB06;H:MW2PR2101MB1034.namprd21.prod.outlook.com;FPR:;SPF:None;PTR:InfoNoRecords;MX:1;A:1;LANG:en; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) x-microsoft-antispam-message-info: xTZB/jIaATNHHx7WjH1LNqlFfpuZdJodxYkjc7j6n2C0K+oJPTKmBFAAs/E94nHhUppa8FHZ58QnBvhDG5cZ01iqmCALsgRI/q19Xrz9CC0B0Tk0Oxgk07lPRnQpUqUGd8aCBKCt6a5FVoiq4uI1mXUAJwHEhPvinv2p1m2wzLY= spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-Network-Message-Id: 4e1c0db7-1756-4d8e-f171-08d58157ef5d X-MS-Exchange-CrossTenant-originalarrivaltime: 03 Mar 2018 22:33:29.1069 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: MW2SPR01MB06 Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: John Johansen [ Upstream commit 622f6e3265707ebf02ba776ac6e68003bcc31213 ] The path_max parameter determines the max size of buffers allocated but it should not be setable at run time. If can be used to cause an oops root@ubuntu:~# echo 16777216 > /sys/module/apparmor/parameters/path_max root@ubuntu:~# cat /sys/module/apparmor/parameters/path_max Killed [ 122.141911] BUG: unable to handle kernel paging request at ffff880080945= fff [ 122.143497] IP: [] d_absolute_path+0x44/0xa0 [ 122.144742] PGD 220c067 PUD 0 [ 122.145453] Oops: 0002 [#1] SMP [ 122.146204] Modules linked in: vmw_vsock_vmci_transport vsock ppdev vmw_= balloon snd_ens1371 btusb snd_ac97_codec gameport snd_rawmidi btrtl snd_seq= _device ac97_bus btbcm btintel snd_pcm input_leds bluetooth snd_timer snd j= oydev soundcore serio_raw coretemp shpchp nfit parport_pc i2c_piix4 8250_fi= ntek vmw_vmci parport mac_hid ib_iser rdma_cm iw_cm ib_cm ib_sa ib_mad ib_c= ore ib_addr iscsi_tcp libiscsi_tcp libiscsi scsi_transport_iscsi autofs4 bt= rfs raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_= tx xor raid6_pq libcrc32c raid1 raid0 multipath linear hid_generic usbhid h= id crct10dif_pclmul crc32_pclmul ghash_clmulni_intel aesni_intel aes_x86_64= lrw gf128mul glue_helper ablk_helper cryptd vmwgfx psmouse mptspi ttm mpts= csih drm_kms_helper mptbase syscopyarea scsi_transport_spi sysfillrect [ 122.163365] ahci sysimgblt e1000 fb_sys_fops libahci drm pata_acpi fjes [ 122.164747] CPU: 3 PID: 1501 Comm: bash Not tainted 4.4.0-59-generic #80= -Ubuntu [ 122.166250] Hardware name: VMware, Inc. VMware Virtual Platform/440BX De= sktop Reference Platform, BIOS 6.00 07/02/2015 [ 122.168611] task: ffff88003496aa00 ti: ffff880076474000 task.ti: ffff880= 076474000 [ 122.170018] RIP: 0010:[] [] d_absol= ute_path+0x44/0xa0 [ 122.171525] RSP: 0018:ffff880076477b90 EFLAGS: 00010206 [ 122.172462] RAX: ffff880080945fff RBX: 0000000000000000 RCX: 00000000010= 00000 [ 122.173709] RDX: 0000000000ffffff RSI: ffff880080946000 RDI: ffff8800348= a1010 [ 122.174978] RBP: ffff880076477bb8 R08: ffff880076477c80 R09: 00000000000= 00000 [ 122.176227] R10: 00007ffffffff000 R11: ffff88007f946000 R12: ffff88007f9= 46000 [ 122.177496] R13: ffff880076477c80 R14: ffff8800348a1010 R15: ffff8800348= a2400 [ 122.178745] FS: 00007fd459eb4700(0000) GS:ffff88007b6c0000(0000) knlGS:= 0000000000000000 [ 122.180176] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 122.181186] CR2: ffff880080945fff CR3: 0000000073422000 CR4: 00000000001= 406e0 [ 122.182469] Stack: [ 122.182843] 00ffffff00000001 ffff880080946000 0000000000000000 00000000= 00000000 [ 122.184409] 00000000570f789c ffff880076477c30 ffffffff81385671 ffff8800= 7a2e7a58 [ 122.185810] 0000000000000000 ffff880076477c88 01000000008a1000 00000000= 00000000 [ 122.187231] Call Trace: [ 122.187680] [] aa_path_name+0x81/0x370 [ 122.188637] [] profile_transition+0xbd/0xb80 [ 122.190181] [] ? zone_statistics+0x7c/0xa0 [ 122.191674] [] apparmor_bprm_set_creds+0x9b0/0xac0 [ 122.193288] [] ? ext4_xattr_get+0x81/0x220 [ 122.194793] [] ? ext4_xattr_security_get+0x1c/0x30 [ 122.196392] [] ? get_vfs_caps_from_disk+0x69/0x110 [ 122.198004] [] ? mnt_may_suid+0x3f/0x50 [ 122.199737] [] ? cap_bprm_set_creds+0xa3/0x600 [ 122.201377] [] security_bprm_set_creds+0x33/0x50 [ 122.203024] [] prepare_binprm+0x85/0x190 [ 122.204515] [] do_execveat_common.isra.33+0x485/0x710 [ 122.206200] [] SyS_execve+0x3a/0x50 [ 122.207615] [] stub_execve+0x5/0x5 [ 122.208978] [] ? entry_SYSCALL_64_fastpath+0x16/0x71 [ 122.210615] Code: f8 31 c0 48 63 c2 83 ea 01 48 c7 45 e8 00 00 00 00 48 = 01 c6 85 d2 48 c7 45 f0 00 00 00 00 48 89 75 e0 89 55 dc 78 0c 48 8d 46 ff = 46 ff 00 48 89 45 e0 48 8d 55 e0 48 8d 4d dc 48 8d 75 e8 e8 [ 122.217320] RIP [] d_absolute_path+0x44/0xa0 [ 122.218860] RSP [ 122.219919] CR2: ffff880080945fff [ 122.220936] ---[ end trace 506cdbd85eb6c55e ]--- Reported-by: Tetsuo Handa Signed-off-by: John Johansen Signed-off-by: James Morris Signed-off-by: Sasha Levin --- security/apparmor/lsm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c index 65ca451a764d..f6be9de35a7f 100644 --- a/security/apparmor/lsm.c +++ b/security/apparmor/lsm.c @@ -735,7 +735,7 @@ module_param_named(logsyscall, aa_g_logsyscall, aabool,= S_IRUSR | S_IWUSR); =20 /* Maximum pathname length before accesses will start getting rejected */ unsigned int aa_g_path_max =3D 2 * PATH_MAX; -module_param_named(path_max, aa_g_path_max, aauint, S_IRUSR | S_IWUSR); +module_param_named(path_max, aa_g_path_max, aauint, S_IRUSR); =20 /* Determines how paranoid loading of policy is and how much verification * on the loaded policy is done. --=20 2.14.1