Received: by 2002:ad5:474a:0:0:0:0:0 with SMTP id i10csp2548367imu; Thu, 29 Nov 2018 06:44:00 -0800 (PST) X-Google-Smtp-Source: AFSGD/WRnZ+HsznrXNowQ7UAwVer4IeOBMqlwm9zh4IL8XZ/FQcP2xfYeTtoXNyzv/jMOj5AlNDk X-Received: by 2002:a17:902:5601:: with SMTP id h1mr1789925pli.160.1543502640101; Thu, 29 Nov 2018 06:44:00 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1543502640; cv=none; d=google.com; s=arc-20160816; b=kOchLzTCEtfRTFIpQXNaTh6e/m6g2sa1EnGub+eeVhXQxxkbGX9MU25rfvxF1NR06P XpcrCTebGwQ26e9s+TOaoZAK0dmN/4u9j8V/0SRl5Bjd/rK9WchVPpn1yGybdNtIpzWa cd7zen0HGMeecpQu0+LuDuc/yiyztqB3YUCEzJA/IIQ/lh55md1LwJF8ijxIlccfnDh+ NGjGoF4HR3Vf15QrUY4iad6MyMyrE47Bh041TxV8DeaUVzE4mwL/ZbhUnYSwsC2sEo4N QMg/HJoxOpYsV0Tj5w6NxItJYlbDFfEqmd3EikD0/H6Z9v1ADLwoC2YL/NkoehAQj/pn sazw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=jbkFwf3UF9QJTiZfRsg7efBRr8cRAjl3+fh0VPfU2LM=; b=PJWaZBqpDF9bZ/6OSvvacVIzAmmmcO5R/yR9UafhX9FbcyHa3gs5lo1Y6W/PSTXbiM sVytybg2kTRUpX/CTIOHQTm4UkZW1hwqeNd73iLeBxeHKcwHzbqZy+68Cw8/UkVWpYbu 9CqSCKjCXZ67enQ/2UvEHwKoe6dc5wxxrVWbk53h5f+Zfs2jz0FQ++YfOocAM1O1Wh7T DuogPkuGq/U1cK9fd+okYlddLpoAf3FtEuQgs4fXtUGgDNs6OEmlT/U6Olokp46n7l+w IcyfVWY+MJ2yKoV1K+2nlpZBzjkTa9QhQ+h2VevG0nyvl36qbbdqbpfKLvqXwWPRdavU LB4Q== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=S0jtn5BO; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id n3-v6si2129687plk.419.2018.11.29.06.43.45; Thu, 29 Nov 2018 06:44:00 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=S0jtn5BO; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2388060AbeK3Bd6 (ORCPT + 99 others); Thu, 29 Nov 2018 20:33:58 -0500 Received: from mail.kernel.org ([198.145.29.99]:34876 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1733011AbeK3Bd6 (ORCPT ); Thu, 29 Nov 2018 20:33:58 -0500 Received: from localhost (5356596B.cm-6-7b.dynamic.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 682A82145D; Thu, 29 Nov 2018 14:28:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1543501704; bh=j7nSJHJntsFJDwKrAyPfJRBAzc92v3smGQ8PB5xgd7k=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=S0jtn5BOSbw+khNYj6w64vHh+nnoYtmpExssGhdl15Oos+IlRp8HXawdl8n+hTAOB CkBhFj4hHH1+7URFCLScRXO8ndpr5gTueLAXTiZIJ5Rh49beCFj7/VgPR0SJyRoP2D B5f2CslcN7JtRougl0mxit1sraUhY1dvmxRCoTgU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Salvatore Mesoraca , Kees Cook , Solar Designer , Al Viro , Dan Carpenter , Andrew Morton , Linus Torvalds , Loic Subject: [PATCH 4.14 092/100] namei: allow restricted O_CREAT of FIFOs and regular files Date: Thu, 29 Nov 2018 15:13:02 +0100 Message-Id: <20181129140106.718416650@linuxfoundation.org> X-Mailer: git-send-email 2.19.2 In-Reply-To: <20181129140058.768942700@linuxfoundation.org> References: <20181129140058.768942700@linuxfoundation.org> User-Agent: quilt/0.65 X-stable: review MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 4.14-stable review patch. If anyone has any objections, please let me know. ------------------ From: Salvatore Mesoraca commit 30aba6656f61ed44cba445a3c0d38b296fa9e8f5 upstream. Disallows open of FIFOs or regular files not owned by the user in world writable sticky directories, unless the owner is the same as that of the directory or the file is opened without the O_CREAT flag. The purpose is to make data spoofing attacks harder. This protection can be turned on and off separately for FIFOs and regular files via sysctl, just like the symlinks/hardlinks protection. This patch is based on Openwall's "HARDEN_FIFO" feature by Solar Designer. This is a brief list of old vulnerabilities that could have been prevented by this feature, some of them even allow for privilege escalation: CVE-2000-1134 CVE-2007-3852 CVE-2008-0525 CVE-2009-0416 CVE-2011-4834 CVE-2015-1838 CVE-2015-7442 CVE-2016-7489 This list is not meant to be complete. It's difficult to track down all vulnerabilities of this kind because they were often reported without any mention of this particular attack vector. In fact, before hardlinks/symlinks restrictions, fifos/regular files weren't the favorite vehicle to exploit them. [s.mesoraca16@gmail.com: fix bug reported by Dan Carpenter] Link: https://lkml.kernel.org/r/20180426081456.GA7060@mwanda Link: http://lkml.kernel.org/r/1524829819-11275-1-git-send-email-s.mesoraca16@gmail.com [keescook@chromium.org: drop pr_warn_ratelimited() in favor of audit changes in the future] [keescook@chromium.org: adjust commit subjet] Link: http://lkml.kernel.org/r/20180416175918.GA13494@beast Signed-off-by: Salvatore Mesoraca Signed-off-by: Kees Cook Suggested-by: Solar Designer Suggested-by: Kees Cook Cc: Al Viro Cc: Dan Carpenter Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Cc: Loic Signed-off-by: Greg Kroah-Hartman --- Documentation/sysctl/fs.txt | 36 +++++++++++++++++++++++++++++ fs/namei.c | 53 +++++++++++++++++++++++++++++++++++++++++--- include/linux/fs.h | 2 + kernel/sysctl.c | 18 ++++++++++++++ 4 files changed, 106 insertions(+), 3 deletions(-) --- a/Documentation/sysctl/fs.txt +++ b/Documentation/sysctl/fs.txt @@ -34,7 +34,9 @@ Currently, these files are in /proc/sys/ - overflowgid - pipe-user-pages-hard - pipe-user-pages-soft +- protected_fifos - protected_hardlinks +- protected_regular - protected_symlinks - suid_dumpable - super-max @@ -182,6 +184,24 @@ applied. ============================================================== +protected_fifos: + +The intent of this protection is to avoid unintentional writes to +an attacker-controlled FIFO, where a program expected to create a regular +file. + +When set to "0", writing to FIFOs is unrestricted. + +When set to "1" don't allow O_CREAT open on FIFOs that we don't own +in world writable sticky directories, unless they are owned by the +owner of the directory. + +When set to "2" it also applies to group writable sticky directories. + +This protection is based on the restrictions in Openwall. + +============================================================== + protected_hardlinks: A long-standing class of security issues is the hardlink-based @@ -202,6 +222,22 @@ This protection is based on the restrict ============================================================== +protected_regular: + +This protection is similar to protected_fifos, but it +avoids writes to an attacker-controlled regular file, where a program +expected to create one. + +When set to "0", writing to regular files is unrestricted. + +When set to "1" don't allow O_CREAT open on regular files that we +don't own in world writable sticky directories, unless they are +owned by the owner of the directory. + +When set to "2" it also applies to group writable sticky directories. + +============================================================== + protected_symlinks: A long-standing class of security issues is the symlink-based --- a/fs/namei.c +++ b/fs/namei.c @@ -904,6 +904,8 @@ static inline void put_link(struct namei int sysctl_protected_symlinks __read_mostly = 0; int sysctl_protected_hardlinks __read_mostly = 0; +int sysctl_protected_fifos __read_mostly; +int sysctl_protected_regular __read_mostly; /** * may_follow_link - Check symlink following for unsafe situations @@ -1017,6 +1019,45 @@ static int may_linkat(struct path *link) return -EPERM; } +/** + * may_create_in_sticky - Check whether an O_CREAT open in a sticky directory + * should be allowed, or not, on files that already + * exist. + * @dir: the sticky parent directory + * @inode: the inode of the file to open + * + * Block an O_CREAT open of a FIFO (or a regular file) when: + * - sysctl_protected_fifos (or sysctl_protected_regular) is enabled + * - the file already exists + * - we are in a sticky directory + * - we don't own the file + * - the owner of the directory doesn't own the file + * - the directory is world writable + * If the sysctl_protected_fifos (or sysctl_protected_regular) is set to 2 + * the directory doesn't have to be world writable: being group writable will + * be enough. + * + * Returns 0 if the open is allowed, -ve on error. + */ +static int may_create_in_sticky(struct dentry * const dir, + struct inode * const inode) +{ + if ((!sysctl_protected_fifos && S_ISFIFO(inode->i_mode)) || + (!sysctl_protected_regular && S_ISREG(inode->i_mode)) || + likely(!(dir->d_inode->i_mode & S_ISVTX)) || + uid_eq(inode->i_uid, dir->d_inode->i_uid) || + uid_eq(current_fsuid(), inode->i_uid)) + return 0; + + if (likely(dir->d_inode->i_mode & 0002) || + (dir->d_inode->i_mode & 0020 && + ((sysctl_protected_fifos >= 2 && S_ISFIFO(inode->i_mode)) || + (sysctl_protected_regular >= 2 && S_ISREG(inode->i_mode))))) { + return -EACCES; + } + return 0; +} + static __always_inline const char *get_link(struct nameidata *nd) { @@ -3355,9 +3396,15 @@ finish_open: if (error) return error; audit_inode(nd->name, nd->path.dentry, 0); - error = -EISDIR; - if ((open_flag & O_CREAT) && d_is_dir(nd->path.dentry)) - goto out; + if (open_flag & O_CREAT) { + error = -EISDIR; + if (d_is_dir(nd->path.dentry)) + goto out; + error = may_create_in_sticky(dir, + d_backing_inode(nd->path.dentry)); + if (unlikely(error)) + goto out; + } error = -ENOTDIR; if ((nd->flags & LOOKUP_DIRECTORY) && !d_can_lookup(nd->path.dentry)) goto out; --- a/include/linux/fs.h +++ b/include/linux/fs.h @@ -72,6 +72,8 @@ extern struct inodes_stat_t inodes_stat; extern int leases_enable, lease_break_time; extern int sysctl_protected_symlinks; extern int sysctl_protected_hardlinks; +extern int sysctl_protected_fifos; +extern int sysctl_protected_regular; typedef __kernel_rwf_t rwf_t; --- a/kernel/sysctl.c +++ b/kernel/sysctl.c @@ -1794,6 +1794,24 @@ static struct ctl_table fs_table[] = { .extra2 = &one, }, { + .procname = "protected_fifos", + .data = &sysctl_protected_fifos, + .maxlen = sizeof(int), + .mode = 0600, + .proc_handler = proc_dointvec_minmax, + .extra1 = &zero, + .extra2 = &two, + }, + { + .procname = "protected_regular", + .data = &sysctl_protected_regular, + .maxlen = sizeof(int), + .mode = 0600, + .proc_handler = proc_dointvec_minmax, + .extra1 = &zero, + .extra2 = &two, + }, + { .procname = "suid_dumpable", .data = &suid_dumpable, .maxlen = sizeof(int),