From patchwork Sat May 26 14:50:46 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Salvatore Mesoraca X-Patchwork-Id: 10428997 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 925D160249 for ; Sat, 26 May 2018 14:51:22 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 81F9F28C2C for ; Sat, 26 May 2018 14:51:22 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 7541929239; Sat, 26 May 2018 14:51:22 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-5.3 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, FREEMAIL_FROM, MAILING_LIST_MULTI, RCVD_IN_DNSWL_MED autolearn=ham version=3.3.1 Received: from mother.openwall.net (mother.openwall.net [195.42.179.200]) by mail.wl.linuxfoundation.org (Postfix) with SMTP id 8B86D28C2C for ; Sat, 26 May 2018 14:51:20 +0000 (UTC) Received: (qmail 19690 invoked by uid 550); 26 May 2018 14:51:17 -0000 Mailing-List: contact kernel-hardening-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-ID: Delivered-To: mailing list kernel-hardening@lists.openwall.com Received: (qmail 19644 invoked from network); 26 May 2018 14:51:17 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id; bh=UfBvKy81DvCZhT/xWeES1XaP2f+fCegu7KUe9s6RsyE=; b=amhVAVdmDv3LxUT7pLpOrBy+cK4L9ogBjhqFOf6GRtS3+7oBLFAonN7ZPXy8JdIgEX SepF+8qD2i1TsOwMaSGKJX9VRJ5+j+046BS1qzkOE87856Jk0r1MfC1HOkDZ18DSv1da 3WAebGDCzJSDOaaYVpYsRliHZKiCoNztEZj/8UbdJwj4Fh2h4iJ+S0HG/rrOLJ7fNMp+ VEmEpFzTFr/Xw1VEcb+3B4FpbfBZFdaIMd6FhkR6PtymPSmg0W6UJ2KJeGoGcQJruxq1 saVGszelyA7O846WC7LIPvFRiWDUB/DxeyvcX/ir16dVCbeGW7YItkksWdRYpbDD7B0Q /qnA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=UfBvKy81DvCZhT/xWeES1XaP2f+fCegu7KUe9s6RsyE=; b=cCpzEnLe56BZa5vSYDRbNvELEe9aiiQ0KmC4tNxc/pniGrhlvXJHR8BzkhG5qmNs3+ MH+SQwHUQAyiUSt7MKGxPitzvdGiOQ9KEZ2oxioFhh4LtQv/+qKhOHHnLAGYFagDjlzn 2s9T+D6aB00d6Qd8871x6HnolQoJiYflSfUcsHK70EFBzyjhIQu5RTuHPSac6KagWGjD EI9diihQItSKv6ymUu6tXrRy/SgY5G3y8okP5jXIB0aSdZmmOznnMUhMI0AUnNzP7yrY pof+0Reg4uZww3trh89PFA6czeANyUsSJPvUjWiA3xP/DX4O835QSo79haoege6oL1Bn MdQw== X-Gm-Message-State: ALKqPwcvgMkQfv2AmImc0+jFbOQqLbRFXG0fS+wdctw/irljhh5bmSWk mVJwlpQTcFxFxHF4uB/qRpimsFffyEw= X-Google-Smtp-Source: AB8JxZpI70kIaDfx2zeQp74N1Uws4eSWwa1+Z6S2l/N7BhtggKwUrtaUM1ThT4lWvQfNFrmAIcvtdw== X-Received: by 2002:a50:a7c3:: with SMTP id i61-v6mr7441728edc.152.1527346265476; Sat, 26 May 2018 07:51:05 -0700 (PDT) From: Salvatore Mesoraca To: kernel-hardening@lists.openwall.com Cc: linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org, linux-mm@kvack.org, Salvatore Mesoraca , Andrew Morton , Alexey Dobriyan , Akinobu Mita , Dmitry Vyukov , Arnd Bergmann , Davidlohr Bueso , Kees Cook Subject: [PATCH] proc: prevent a task from writing on its own /proc/*/mem Date: Sat, 26 May 2018 16:50:46 +0200 Message-Id: <1527346246-1334-1-git-send-email-s.mesoraca16@gmail.com> X-Mailer: git-send-email 1.9.1 X-Virus-Scanned: ClamAV using ClamSMTP Prevent a task from opening, in "write" mode, any /proc/*/mem file that operates on the task's mm. /proc/*/mem is mainly a debugging means and, as such, it shouldn't be used by the inspected process itself. Current implementation always allow a task to access its own /proc/*/mem file. A process can use it to overwrite read-only memory, making pointless the use of security_file_mprotect() or other ways to enforce RO memory. Signed-off-by: Salvatore Mesoraca --- fs/proc/base.c | 25 ++++++++++++++++++------- fs/proc/internal.h | 3 ++- fs/proc/task_mmu.c | 4 ++-- fs/proc/task_nommu.c | 2 +- 4 files changed, 23 insertions(+), 11 deletions(-) diff --git a/fs/proc/base.c b/fs/proc/base.c index 1a76d75..01ecfec 100644 --- a/fs/proc/base.c +++ b/fs/proc/base.c @@ -762,8 +762,9 @@ static int proc_single_open(struct inode *inode, struct file *filp) .release = single_release, }; - -struct mm_struct *proc_mem_open(struct inode *inode, unsigned int mode) +struct mm_struct *proc_mem_open(struct inode *inode, + unsigned int mode, + fmode_t f_mode) { struct task_struct *task = get_proc_task(inode); struct mm_struct *mm = ERR_PTR(-ESRCH); @@ -773,10 +774,20 @@ struct mm_struct *proc_mem_open(struct inode *inode, unsigned int mode) put_task_struct(task); if (!IS_ERR_OR_NULL(mm)) { - /* ensure this mm_struct can't be freed */ - mmgrab(mm); - /* but do not pin its memory */ - mmput(mm); + /* + * Prevent this interface from being used as a mean + * to bypass memory restrictions, including those + * imposed by LSMs. + */ + if (mm == current->mm && + f_mode & FMODE_WRITE) + mm = ERR_PTR(-EACCES); + else { + /* ensure this mm_struct can't be freed */ + mmgrab(mm); + /* but do not pin its memory */ + mmput(mm); + } } } @@ -785,7 +796,7 @@ struct mm_struct *proc_mem_open(struct inode *inode, unsigned int mode) static int __mem_open(struct inode *inode, struct file *file, unsigned int mode) { - struct mm_struct *mm = proc_mem_open(inode, mode); + struct mm_struct *mm = proc_mem_open(inode, mode, file->f_mode); if (IS_ERR(mm)) return PTR_ERR(mm); diff --git a/fs/proc/internal.h b/fs/proc/internal.h index 0f1692e..8d38cc7 100644 --- a/fs/proc/internal.h +++ b/fs/proc/internal.h @@ -275,7 +275,8 @@ struct proc_maps_private { #endif } __randomize_layout; -struct mm_struct *proc_mem_open(struct inode *inode, unsigned int mode); +struct mm_struct *proc_mem_open(struct inode *inode, unsigned int mode, + fmode_t f_mode); extern const struct file_operations proc_pid_maps_operations; extern const struct file_operations proc_tid_maps_operations; diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c index c486ad4..efb6535 100644 --- a/fs/proc/task_mmu.c +++ b/fs/proc/task_mmu.c @@ -227,7 +227,7 @@ static int proc_maps_open(struct inode *inode, struct file *file, return -ENOMEM; priv->inode = inode; - priv->mm = proc_mem_open(inode, PTRACE_MODE_READ); + priv->mm = proc_mem_open(inode, PTRACE_MODE_READ, file->f_mode); if (IS_ERR(priv->mm)) { int err = PTR_ERR(priv->mm); @@ -1534,7 +1534,7 @@ static int pagemap_open(struct inode *inode, struct file *file) { struct mm_struct *mm; - mm = proc_mem_open(inode, PTRACE_MODE_READ); + mm = proc_mem_open(inode, PTRACE_MODE_READ, file->f_mode); if (IS_ERR(mm)) return PTR_ERR(mm); file->private_data = mm; diff --git a/fs/proc/task_nommu.c b/fs/proc/task_nommu.c index 5b62f57..dc38516 100644 --- a/fs/proc/task_nommu.c +++ b/fs/proc/task_nommu.c @@ -280,7 +280,7 @@ static int maps_open(struct inode *inode, struct file *file, return -ENOMEM; priv->inode = inode; - priv->mm = proc_mem_open(inode, PTRACE_MODE_READ); + priv->mm = proc_mem_open(inode, PTRACE_MODE_READ, file->f_mode); if (IS_ERR(priv->mm)) { int err = PTR_ERR(priv->mm);