From patchwork Sat Oct 21 13:24:46 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Nicolas Belouin X-Patchwork-Id: 10021415 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id B511B60234 for ; Sat, 21 Oct 2017 14:00:40 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 971AE285A4 for ; Sat, 21 Oct 2017 14:00:40 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 8B96928BCD; Sat, 21 Oct 2017 14:00:40 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.2 required=2.0 tests=BAYES_00, RCVD_IN_DNSWL_MED autolearn=ham version=3.3.1 Received: from mother.openwall.net (mother.openwall.net [195.42.179.200]) by mail.wl.linuxfoundation.org (Postfix) with SMTP id A1765285A4 for ; Sat, 21 Oct 2017 14:00:38 +0000 (UTC) Received: (qmail 7866 invoked by uid 550); 21 Oct 2017 14:00:35 -0000 Mailing-List: contact kernel-hardening-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-ID: Delivered-To: mailing list kernel-hardening@lists.openwall.com Delivered-To: moderator for kernel-hardening@lists.openwall.com Received: (qmail 12009 invoked from network); 21 Oct 2017 13:25:24 -0000 From: Nicolas Belouin To: Alexander Viro , linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org, linux-api@vger.kernel.org, kernel-hardening@lists.openwall.com Cc: Nicolas Belouin Date: Sat, 21 Oct 2017 15:24:46 +0200 Message-Id: <20171021132446.17567-1-nicolas@belouin.fr> X-Mailer: git-send-email 2.14.2 X-Antivirus: Dr.Web (R) for Unix mail servers drweb plugin ver.6.0.2.8 X-Antivirus-Code: 0x100000 Subject: [kernel-hardening] [PATCH] fs: check for DAC_READ_SEARCH instead of SYS_ADMIN X-Virus-Scanned: ClamAV using ClamSMTP These checks are meant to prevent leaks or attacks via directory traversal, the use of CAP_SYS_ADMIN here is a misuse, CAP_DAC_READ_SEARCH being way more appropriate as a process with CAP_DAC_READ_SEARCH is entrusted with going trough all directories. CAP_SYS_ADMIN is not meant to flag such a process. Signed-off-by: Nicolas Belouin --- fs/dcookies.c | 2 +- fs/proc/base.c | 8 ++++---- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/fs/dcookies.c b/fs/dcookies.c index 0d0461cf2431..48491299a183 100644 --- a/fs/dcookies.c +++ b/fs/dcookies.c @@ -158,7 +158,7 @@ SYSCALL_DEFINE3(lookup_dcookie, u64, cookie64, char __user *, buf, size_t, len) /* we could leak path information to users * without dir read permission without this */ - if (!capable(CAP_SYS_ADMIN)) + if (!capable(CAP_SYS_ADMIN) && !capable(CAP_DAC_READ_SEARCH)) return -EPERM; mutex_lock(&dcookie_mutex); diff --git a/fs/proc/base.c b/fs/proc/base.c index ad3b0762cc3e..965a3aa1a77f 100644 --- a/fs/proc/base.c +++ b/fs/proc/base.c @@ -2006,16 +2006,16 @@ struct map_files_info { }; /* - * Only allow CAP_SYS_ADMIN to follow the links, due to concerns about how the - * symlinks may be used to bypass permissions on ancestor directories in the - * path to the file in question. + * Only allow CAP_SYS_ADMIN or CAP_DAC_READ_SEARCH to follow the links, due + * to concerns about how the symlinks may be used to bypass permissions on + * ancestor directories in the path to the file in question. */ static const char * proc_map_files_get_link(struct dentry *dentry, struct inode *inode, struct delayed_call *done) { - if (!capable(CAP_SYS_ADMIN)) + if (!capable(CAP_SYS_ADMIN) && !capable(CAP_DAC_READ_SEARCH)) return ERR_PTR(-EPERM); return proc_pid_get_link(dentry, inode, done);