From patchwork Thu Aug 1 12:07:45 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Wojciech_G=C5=82adysz?= X-Patchwork-Id: 13750264 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9B5D2C3DA64 for ; Thu, 1 Aug 2024 12:08:31 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id E6B1B6B007B; Thu, 1 Aug 2024 08:08:30 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id E1B736B0082; Thu, 1 Aug 2024 08:08:30 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id CBC416B0083; Thu, 1 Aug 2024 08:08:30 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0015.hostedemail.com [216.40.44.15]) by kanga.kvack.org (Postfix) with ESMTP id AEA496B007B for ; Thu, 1 Aug 2024 08:08:30 -0400 (EDT) Received: from smtpin08.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay09.hostedemail.com (Postfix) with ESMTP id 620FC80CBE for ; Thu, 1 Aug 2024 12:08:30 +0000 (UTC) X-FDA: 82403554380.08.1DB2201 Received: from mail-ej1-f44.google.com (mail-ej1-f44.google.com [209.85.218.44]) by imf10.hostedemail.com (Postfix) with ESMTP id C2AF5C0011 for ; Thu, 1 Aug 2024 12:08:26 +0000 (UTC) Authentication-Results: imf10.hostedemail.com; dkim=pass header.d=infogain-com.20230601.gappssmtp.com header.s=20230601 header.b=YkvXQp1S; spf=fail (imf10.hostedemail.com: domain of wojciech.gladysz@infogain.com does not designate 209.85.218.44 as permitted sender) smtp.mailfrom=wojciech.gladysz@infogain.com; dmarc=fail reason="No valid SPF, DKIM not aligned (relaxed)" header.from=infogain.com (policy=quarantine) ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1722514101; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding:in-reply-to: references:dkim-signature; bh=nB/idpKvpCC5AMBAVtxITho2KioK5WwQCn31MARLVcA=; b=7eklA73msYuYdQDXUMtw4Kw/dK4vpEMhVuKZaQlbwbyFpRtkhlO2LWBoZAcbZnBte4lbNo kPZ8ncHHMtEoU2QGyCIihmBV7X/CPHDDyBsRwNSwdnHLDNuUg3niI3ka6XrlKaSKhFKPrS 6p20J4Y/D6JFzLdXL/SQuQ2oJ7h1Gxo= ARC-Authentication-Results: i=1; imf10.hostedemail.com; dkim=pass header.d=infogain-com.20230601.gappssmtp.com header.s=20230601 header.b=YkvXQp1S; spf=fail (imf10.hostedemail.com: domain of wojciech.gladysz@infogain.com does not designate 209.85.218.44 as permitted sender) smtp.mailfrom=wojciech.gladysz@infogain.com; dmarc=fail reason="No valid SPF, DKIM not aligned (relaxed)" header.from=infogain.com (policy=quarantine) ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1722514101; a=rsa-sha256; cv=none; b=PfBKKcT8lmP5PUVnJxdiu2/n3K/ykPhW4f6D5Y5EMEuNeGALvMlmrhKYDuFG8t5Wa66GyZ KYADdDwMT2uHPpRvhkBSFxsCslvkTYm95FlqV244QUKW+eZqPGlbhVYuinH3EL1Ruti1kK p6lT75bPi5FjKtkgd7v3mtH5pzzdKfE= Received: by mail-ej1-f44.google.com with SMTP id a640c23a62f3a-a728f74c23dso905788666b.1 for ; Thu, 01 Aug 2024 05:08:26 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=infogain-com.20230601.gappssmtp.com; s=20230601; t=1722514105; x=1723118905; darn=kvack.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=nB/idpKvpCC5AMBAVtxITho2KioK5WwQCn31MARLVcA=; b=YkvXQp1S6SS20DIyHyF0EJMBDMdDvRTZvFcncQ9yiEn6k6XrFrtpN6um92au8yie5a /y3wc8GeTgS0eVroH9++jHuj8NRvEr0aFcXk39fcus1tTlf4U8U/xVBiQ4qIQ8WKGrhF zm7ng0cNqRNaLkoxLIwLrVzY82W5kQ5mvXUY6FmAWSnmvjv/jX1MKNvC1TY96cwofvSh 1MyikG3jnqzx/pIyfrgJkETsKs/uHdVatQCTa9HHvHkazHnWFf36mL0E/HrnhVWqQzIm VrkvpT3hhe+CcmoBOWmGZ175P4UdtWDl5MDwDdyBo36UVPaONsd5wB1jC16n7WT3Qh5n 219w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1722514105; x=1723118905; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=nB/idpKvpCC5AMBAVtxITho2KioK5WwQCn31MARLVcA=; b=XIvNxAxCIsZ08rUxssifojx51QDR98e565tr6muF8qqwQKnKmEsHqAUKKKmhXkQ3pb DvxYuQUexxkUrNZ1hAYvxFm0vkvmFjb10OhfvqFLuQCh9w9A+gZFa/CxMtHccbR2yPWC mNLDzpN7EhV6XzkT5d7/BDp1n01C8VuwDwBioGMJugz1n2d0f23VF4uEyX7Ak7bZJvmB Yw3BVZ6yVdBW6YVLXrOpVuQwefP+DV14zHu91xkV7pnpXlUF9ybMdQNsIYYSv6O8q9UZ zmzqzgnIPpOaVRMq+FNgvsD5OLPr0BK54eXmu6kiIIRod4MKLSYuIGZExAnFJZEoeIY/ k7xw== X-Forwarded-Encrypted: i=1; AJvYcCVVG8gr2Jk4YpiGNcgn9iJTzGM+199qB+OQf0cvPED9xlgbN3OE1yv8uaJ+DoDHvzPciw0ymZ7Ng9y6dg+eBGuyLrA= X-Gm-Message-State: AOJu0YwHvrrutYHsbShwqc8YdNA3J16XH8C6jEu5gaEKavicVtfUgB0H QJNTikJz7hilVuW3D4UuKcXgZf2i4bsxZHoVyyy5qUBMTixYceYN0eMmxvwow1k= X-Google-Smtp-Source: AGHT+IFVqIRaH4uLNDl8kuzBw0JjVatO72588Ewo/xAcVdYA3RWoyNva4io93ZY9i0b22EJTh5oC+A== X-Received: by 2002:a17:907:94cc:b0:a7a:a7b8:ada3 with SMTP id a640c23a62f3a-a7daf7929c1mr183395266b.3.1722514104389; Thu, 01 Aug 2024 05:08:24 -0700 (PDT) Received: from localhost.localdomain (apn-31-0-3-137.dynamic.gprs.plus.pl. [31.0.3.137]) by smtp.gmail.com with ESMTPSA id a640c23a62f3a-a7acab4dec6sm890783066b.61.2024.08.01.05.08.22 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 01 Aug 2024 05:08:23 -0700 (PDT) From: =?utf-8?q?Wojciech_G=C5=82adysz?= To: viro@zeniv.linux.org.uk, brauner@kernel.org, jack@suse.cz, ebiederm@xmission.com, kees@kernel.org, linux-fsdevel@vger.kernel.org, linux-mm@kvack.org, linux-kernel@vger.kernel.org Cc: =?utf-8?q?Wojciech_G=C5=82adysz?= Subject: [PATCH] kernel/fs: last check for exec credentials on NOEXEC mount Date: Thu, 1 Aug 2024 14:07:45 +0200 Message-Id: <20240801120745.13318-1-wojciech.gladysz@infogain.com> X-Mailer: git-send-email 2.35.3 MIME-Version: 1.0 X-Rspam-User: X-Stat-Signature: 1tmgar7zyg5cdcx9see4iiac9subitac X-Rspamd-Pre-Result: action=add header; module=dmarc; Action set by DMARC X-Rspamd-Queue-Id: C2AF5C0011 X-Rspamd-Server: rspam11 X-Rspam: Yes X-HE-Tag: 1722514106-708444 X-HE-Meta: U2FsdGVkX1+wFRqIzjBs3chj9X/kc3ccDet0sy2DjO7Fmthnf7d/W2+pjrdcB5zYSz7F5b457UNEmr+sUKc3rCB2ClNK7Km7GFyNqP0XWmJ1QihniYcedb4h6EeOSU3eh0A0ewBt4kkYkz0rnJVtVjFsblZdp6bYEeU2m14UuHZf5AMXOy4iUJfL+zrfsb7eZaEMYdgAP7EqquBlySYj5wQH8O1pMIxCGMjmbjU+0ta+O3lc2H4a3K/LaKfutCHQGumd9XTbvmmbGe4Qzd7lSAb3SRTsWwFUiBYEM5I5pQaseXRUwxr7XPfSsdHrV2i/4Jyd1fKs35C3tYt9IIjn1aLygGRqnDoTFTXErjydGU1/jelr10PXQyYNI9o5AuGqNDj2ZI0e0xZuwhJcDz8JhbCxo5orsFWuWeVVG/+BjxBcnd87Owp4ZQfEpNRt92/uGUJP61WuY2ehtyRkGcyXAwThVHUqEfqRlEqhNvti4lqsYJxO5DR9Z9cCx3OOG7ZCddJOhyCk5CUKzBYTI0IPJu4cI66ca0iMlIsCLPuGufzS2NjG7DP0OVPSvh3xhS8CBLHWHe5eEVs/3hX/0NHv6n6TedpCqhaLJeZGbu3jAg+evwR5M2Ci172a3Ud5KvWQaqUyAovPb2l7KSGeh6le2kHA50G7k7TimG8urIMtP0o9rDpW2+dIa2yeGtOBzW9rv4Smt0jY+SWy0GQgSkyt+VB1dhdSPVMLrAxRaw6N3T77e2XvHFqIioIu63vKJsEnprK5rKpaXrho+m942ubfvwmS29DGtjBPuYolWuZ6YRZ0Vfj3NqB2dhmLwpRD/mvZAqsjeWwDwVDsjRZtj31L7MOL4mn2r7Qur2PEkQ8Wq8ZPc6pjad93AJd7nue25yxjy94CuxgehHRhYTgsgp6xqhQZEeGs9100mpFdSLWjWMwneEth4323HOElST3/EQuyhXiyWo3f/E9fvxOGCCq wT2Y307p jc1HFGLTusfKRT9uTSiuhGkRnxuPvkjpamlRwt2EN1m4Z/8rjdCIxTeavUDkYAjTsLor0/4d2K4R3ZQJpdSTvCvy22XDDEfo7O9i370DI0xVXZ1/CdPTm1uCRr7f5yyDCt8SZnSntUpP6AsnBtSSvW7lJJB91AoF4eFHwabFKZzAFpAXpzxBtHo3NuHEE/om0ufIyiBivRBt/BC+UmxfoSyIgbpmLolU5wflajzlPB4uHXlnVxXzAwepwiqvyim6yyclEyfmclSytvrvyjhzJxqCsiWWD4fXi9I3KRZnYi2s6WWDplK5UJU9L4On9A9uTy3YchEo7PRhB3NZxbYiVL4kDHV2agZRHA+9z7GJTvrW71qk9fsvWA60FKLErrTct6IYQ/IgtZf8dpEUom2I/EnAz9pd8rAb6E4wPF1TvjmNQOzMxQ+/Y9e3cD5HkLQwS7kg6ICoyyZ+NjjZgoDUn9izl/iNUHnNuUGd3droSyjpltjIgdmn6gx3rBG79GSTGu70ZdekXc1pnDxQ= X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: Test case: thread mounts NOEXEC fuse to a file being executed. WARN_ON_ONCE is triggered yielding panic for some config. Add a check to security_bprm_creds_for_exec(bprm). Stack trace: ------------[ cut here ]------------ WARNING: CPU: 0 PID: 2736 at fs/exec.c:933 do_open_execat+0x311/0x710 fs/exec.c:932 Modules linked in: CPU: 0 PID: 2736 Comm: syz-executor384 Not tainted 5.10.0-syzkaller #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 RIP: 0010:do_open_execat+0x311/0x710 fs/exec.c:932 Code: 89 de e8 02 b1 a1 ff 31 ff 89 de e8 f9 b0 a1 ff 45 84 ff 75 2e 45 85 ed 0f 8f ed 03 00 00 e8 56 ae a1 ff eb bd e8 4f ae a1 ff <0f> 0b 48 c7 c3 f3 ff ff ff 4c 89 f7 e8 9e cb fe ff 49 89 de e9 2d RSP: 0018:ffffc90008e07c20 EFLAGS: 00010293 RAX: ffffffff82131ac6 RBX: 0000000000000004 RCX: ffff88801a6611c0 RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000000 RBP: ffffc90008e07cf0 R08: ffffffff8213173f R09: ffffc90008e07aa0 R10: 0000000000000000 R11: dffffc0000000001 R12: ffff8880115810e0 R13: dffffc0000000000 R14: ffff88801122c040 R15: ffffc90008e07c60 FS: 00007f9e283ce6c0(0000) GS:ffff888058a00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f9e2848600a CR3: 00000000139de000 CR4: 0000000000352ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: bprm_execve+0x60b/0x1c40 fs/exec.c:1939 do_execveat_common+0x5a6/0x770 fs/exec.c:2077 do_execve fs/exec.c:2147 [inline] __do_sys_execve fs/exec.c:2223 [inline] __se_sys_execve fs/exec.c:2218 [inline] __x64_sys_execve+0x92/0xb0 fs/exec.c:2218 do_syscall_64+0x6d/0xa0 arch/x86/entry/common.c:62 entry_SYSCALL_64_after_hwframe+0x61/0xcb RIP: 0033:0x7f9e2842f299 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 b1 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f9e283ce218 EFLAGS: 00000246 ORIG_RAX: 000000000000003b RAX: ffffffffffffffda RBX: 00007f9e284bd3f8 RCX: 00007f9e2842f299 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000020000400 RBP: 00007f9e284bd3f0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007f9e2848a134 R13: 0030656c69662f2e R14: 00007ffc819a23d0 R15: 00007f9e28488130 Signed-off-by: Wojciech Gładysz --- fs/exec.c | 42 +++++++++++++++++++----------------------- 1 file changed, 19 insertions(+), 23 deletions(-) diff --git a/fs/exec.c b/fs/exec.c index a126e3d1cacb..0cc6a7d033a1 100644 --- a/fs/exec.c +++ b/fs/exec.c @@ -953,8 +953,6 @@ EXPORT_SYMBOL(transfer_args_to_stack); */ static struct file *do_open_execat(int fd, struct filename *name, int flags) { - struct file *file; - int err; struct open_flags open_exec_flags = { .open_flag = O_LARGEFILE | O_RDONLY | __FMODE_EXEC, .acc_mode = MAY_EXEC, @@ -969,26 +967,7 @@ static struct file *do_open_execat(int fd, struct filename *name, int flags) if (flags & AT_EMPTY_PATH) open_exec_flags.lookup_flags |= LOOKUP_EMPTY; - file = do_filp_open(fd, name, &open_exec_flags); - if (IS_ERR(file)) - goto out; - - /* - * may_open() has already checked for this, so it should be - * impossible to trip now. But we need to be extra cautious - * and check again at the very end too. - */ - err = -EACCES; - if (WARN_ON_ONCE(!S_ISREG(file_inode(file)->i_mode) || - path_noexec(&file->f_path))) - goto exit; - -out: - return file; - -exit: - fput(file); - return ERR_PTR(err); + return do_filp_open(fd, name, &open_exec_flags); } /** @@ -1730,6 +1709,23 @@ static void bprm_fill_uid(struct linux_binprm *bprm, struct file *file) } } +static int bprm_creds_for_exec(struct linux_binprm *bprm) +{ + struct file *file = bprm->file; + + /* + * Do not execute a regular file on NOEXEC mount. + * May_open() has already checked for this but a NOEXEC mount + * operation may have happened to the file since then (fuse). + * This is the last check point. + */ + if (!S_ISREG(file_inode(file)->i_mode) || + path_noexec(&file->f_path)) + return -EACCES; + + return security_bprm_creds_for_exec(bprm); +} + /* * Compute brpm->cred based upon the final binary. */ @@ -1907,7 +1903,7 @@ static int bprm_execve(struct linux_binprm *bprm) sched_exec(); /* Set the unchanging part of bprm->cred */ - retval = security_bprm_creds_for_exec(bprm); + retval = bprm_creds_for_exec(bprm); if (retval) goto out;