Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
IronPort-PHdr: =?us-ascii?q?9a23=3AWElPzRLjFEfDaonAE9mcpTZWNBhigK39O0sv0r?=
 =?us-ascii?q?FitYgXKvn/rarrMEGX3/hxlliBBdydt6obzbKO+4nbGkU4qa6bt34DdJEeHz?=
 =?us-ascii?q?Qksu4x2zIaPcieFEfgJ+TrZSFpVO5LVVti4m3peRMNQJW2aFLduGC94iAPER?=
 =?us-ascii?q?vjKwV1Ov71GonPhMiryuy+4ZLebxlKiTanfb9+MAi9oBnMuMURnYZsMLs6xA?=
 =?us-ascii?q?HTontPdeRWxGdoKkyWkh3h+Mq+/4Nt/jpJtf45+MFOTav1f6IjTbxFFzsmKH?=
 =?us-ascii?q?w65NfqtRbYUwSC4GYXX3gMnRpJBwjF6wz6Xov0vyDnuOdxxDWWMMvrRr0vRz?=
 =?us-ascii?q?+s87lkRwPpiCcfNj427mfXitBrjKlGpB6tvgFzz5LIbI2QMvdxcLndfdcHTm?=
 =?us-ascii?q?RfWMhfWTFKDoelY4cRE+YNOOBVpJT/qVQTtxuzHRSiCv3hyjFIhXH406M13O?=
 =?us-ascii?q?sjHg7a0wItBM4OvXfOodnpKKsfX+K4wa/VxjvDdfNW3jL95ZDVfBA9v/6MRb?=
 =?us-ascii?q?JwftTXyUIyCg3Fi0+fqYjhPzyL1uUGrm+W7/F9WuK0kGMntwFwrSSvxscrkI?=
 =?us-ascii?q?XJgJkVxUre+SV2x4Y1O8S1RUhmatCnCJtdrzyWOoR5T884Q2xkpTw2xqMJtJ?=
 =?us-ascii?q?KlZiQG1ZIqzAPFZfOdaYiH+BfjWf6UITd/mX1qZqqyhw238Ui80u38UdS00E?=
 =?us-ascii?q?pSoipFjNbMsncN2gTP6sedUPt9/1qh2S2V2wDP6uBLPUA0la3BJ54n3rEwjY?=
 =?us-ascii?q?YcvV7GHi/3nEX6lK6WdkM69ei08+nrf7rrq5CGO4J0lw3yKLoil8OhDegiLw?=
 =?us-ascii?q?QCR22b9v691L3n8035WrJKjvgun6nCrZ/aPt8WprK5AgBJ0oYj7AyzDzG90N?=
 =?us-ascii?q?sCh3UHI1VFeAyfg4jzJ17OOOz4Deu4g1m0kTZr2/fGPrvuApjWMHjDjK3tcq?=
 =?us-ascii?q?hg5E5B0AAz18xQ54pICrEdJ/L+QkvxtN3eDh8kPA242ujnCM5g2YwAR2KAHK?=
 =?us-ascii?q?uZPbjMsV+H+O0vOfOAZIwLtzbnLfgq+frugWU+mV8HcqmjxYEXZ2ygHvR6P0?=
 =?us-ascii?q?WZZmLhgtMAEWcMowo/Q/XmiF6cXj5JYXa9QaY86yolCIKpE4jDXJqhgL+f0y?=
 =?us-ascii?q?ehGJ1ZeGRGBkqLEXfyeIWOQ+0MZz6KIs99jjwEUqCsS4sg1RGoqQ/7xKNrLv?=
 =?us-ascii?q?HK9SIEqJLjztl15/HTlB0r8Dx0CNmS03yJT25qhW4IWTA2075loUBnyVeMz7?=
 =?us-ascii?q?J4g/pGGtxX/f9JVR06NZHExexgF9/yQh7BfsuOSFu+TNSpHzcxQck2w9MUeE?=
 =?us-ascii?q?ZwAM6igQrG3yqxHr8VkbOLCIYo/aLb2niib/p6nkrB0qZpvVkvRMQHYX+6ga?=
 =?us-ascii?q?hw3xbPQYPFjhPKubytcPEnwCPV9GqFhVGLtUVcXR84Bb7JRlgDd0DWqpL//U?=
 =?us-ascii?q?qEQLiwX+d0ejBdwNKPf/MZIubiik9LEbK6YozT?=
Subject: Re: Leaking path for search_binary_handler
To:     Tong Zhang <ztong@vt.edu>
Cc:     linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org,
        linux-security-module@vger.kernel.org, wenbo.s@samsung.com
References: <C2D9C687-4964-4DB3-AAF4-7C836324D6BE@vt.edu>
From:   Stephen Smalley <sds@tycho.nsa.gov>
Message-ID: <e36e7259-5cf8-3c5b-98d3-5c4d5c4b82b1@tycho.nsa.gov>
Date:   Wed, 26 Sep 2018 08:59:38 -0400
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101
 Thunderbird/52.9.1
MIME-Version: 1.0
In-Reply-To: <C2D9C687-4964-4DB3-AAF4-7C836324D6BE@vt.edu>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Language: en-US
Content-Transfer-Encoding: 8bit
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

On 09/25/2018 01:27 PM, Tong Zhang wrote:
> Kernel Version: 4.18.5
> 
> Problem Description:
> 
> search_binary_handler() should be called after setting bprm using prepare_binprm(),
> and in prepare_binprm(), there’s a LSM hook security_bprm_set_creds(),
> which can make a decision that binfmt cares.
> 
> We found a leaking path In fs/binfmt_misc.c:235, that don’t ask LSM’s decision.

Do you mean the MISC_FMT_CREDENTIALS case? That looks intentional to me, 
as noted in the comment there, and as per 
Documentation/admin-guide/binfmt-misc.rst's discussion of the 
credentials flag.