From patchwork Sat May 26 14:50:46 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Salvatore Mesoraca X-Patchwork-Id: 10428993 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 9BF976038C for ; Sat, 26 May 2018 14:51:10 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 8C45A28C2C for ; Sat, 26 May 2018 14:51:10 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 7FA6729239; Sat, 26 May 2018 14:51:10 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=2.0 tests=BAYES_00, DKIM_ADSP_CUSTOM_MED, DKIM_SIGNED,FREEMAIL_FROM,RCVD_IN_DNSWL_HI,T_DKIM_INVALID autolearn=unavailable version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id E955329215 for ; Sat, 26 May 2018 14:51:08 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1031790AbeEZOvH (ORCPT ); Sat, 26 May 2018 10:51:07 -0400 Received: from mail-wm0-f67.google.com ([74.125.82.67]:52461 "EHLO mail-wm0-f67.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1031779AbeEZOvG (ORCPT ); Sat, 26 May 2018 10:51:06 -0400 Received: by mail-wm0-f67.google.com with SMTP id 18-v6so15771925wml.2; Sat, 26 May 2018 07:51:06 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id; bh=UfBvKy81DvCZhT/xWeES1XaP2f+fCegu7KUe9s6RsyE=; b=amhVAVdmDv3LxUT7pLpOrBy+cK4L9ogBjhqFOf6GRtS3+7oBLFAonN7ZPXy8JdIgEX SepF+8qD2i1TsOwMaSGKJX9VRJ5+j+046BS1qzkOE87856Jk0r1MfC1HOkDZ18DSv1da 3WAebGDCzJSDOaaYVpYsRliHZKiCoNztEZj/8UbdJwj4Fh2h4iJ+S0HG/rrOLJ7fNMp+ VEmEpFzTFr/Xw1VEcb+3B4FpbfBZFdaIMd6FhkR6PtymPSmg0W6UJ2KJeGoGcQJruxq1 saVGszelyA7O846WC7LIPvFRiWDUB/DxeyvcX/ir16dVCbeGW7YItkksWdRYpbDD7B0Q /qnA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=UfBvKy81DvCZhT/xWeES1XaP2f+fCegu7KUe9s6RsyE=; b=LQD52hmqJBoXUK5O0SAmz0YNsnsbWJ+4+J1btN77PjEf7n9RBPQJV8mLJ+2+/LBpdu m4gwfnXNL2yrjvZdUdmPJFvK0gCTQeYRtp44XIwy7TOJ27A5SLUfdTs3lk933/Z7kL3G 5Cv3acetv+06zmgdRsoM6e2C2sLogQpGrs4s+juDciig/pXKqNIfad1U3kuwN3AP9jtt F6AEYD0xU1PZTmPMHBybYJR+lSJaBTE+Ti3Adtr4209adHPwW/WIa202beCB3UwtUgDd XFjFssvbgQRqfVJChyRdlhg4/qGS7cqlgPJXWXOXr3hgXoEjkeWaiGR09FR4/27hQIFp 7K9A== X-Gm-Message-State: ALKqPwflKmdaMbFs4Wna6RGyDlvEFB+Facp26XUXaLlsbgcpXk36Ct8u JEDTzmZi4d1lax3sn5bIqj8= X-Google-Smtp-Source: AB8JxZpI70kIaDfx2zeQp74N1Uws4eSWwa1+Z6S2l/N7BhtggKwUrtaUM1ThT4lWvQfNFrmAIcvtdw== X-Received: by 2002:a50:a7c3:: with SMTP id i61-v6mr7441728edc.152.1527346265476; Sat, 26 May 2018 07:51:05 -0700 (PDT) Received: from localhost ([109.112.8.251]) by smtp.gmail.com with ESMTPSA id e56-v6sm2736493edb.31.2018.05.26.07.51.03 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Sat, 26 May 2018 07:51:04 -0700 (PDT) From: Salvatore Mesoraca To: kernel-hardening@lists.openwall.com Cc: linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org, linux-mm@kvack.org, Salvatore Mesoraca , Andrew Morton , Alexey Dobriyan , Akinobu Mita , Dmitry Vyukov , Arnd Bergmann , Davidlohr Bueso , Kees Cook Subject: [PATCH] proc: prevent a task from writing on its own /proc/*/mem Date: Sat, 26 May 2018 16:50:46 +0200 Message-Id: <1527346246-1334-1-git-send-email-s.mesoraca16@gmail.com> X-Mailer: git-send-email 1.9.1 Sender: owner-linux-security-module@vger.kernel.org Precedence: bulk List-ID: X-Virus-Scanned: ClamAV using ClamSMTP Prevent a task from opening, in "write" mode, any /proc/*/mem file that operates on the task's mm. /proc/*/mem is mainly a debugging means and, as such, it shouldn't be used by the inspected process itself. Current implementation always allow a task to access its own /proc/*/mem file. A process can use it to overwrite read-only memory, making pointless the use of security_file_mprotect() or other ways to enforce RO memory. Signed-off-by: Salvatore Mesoraca --- fs/proc/base.c | 25 ++++++++++++++++++------- fs/proc/internal.h | 3 ++- fs/proc/task_mmu.c | 4 ++-- fs/proc/task_nommu.c | 2 +- 4 files changed, 23 insertions(+), 11 deletions(-) diff --git a/fs/proc/base.c b/fs/proc/base.c index 1a76d75..01ecfec 100644 --- a/fs/proc/base.c +++ b/fs/proc/base.c @@ -762,8 +762,9 @@ static int proc_single_open(struct inode *inode, struct file *filp) .release = single_release, }; - -struct mm_struct *proc_mem_open(struct inode *inode, unsigned int mode) +struct mm_struct *proc_mem_open(struct inode *inode, + unsigned int mode, + fmode_t f_mode) { struct task_struct *task = get_proc_task(inode); struct mm_struct *mm = ERR_PTR(-ESRCH); @@ -773,10 +774,20 @@ struct mm_struct *proc_mem_open(struct inode *inode, unsigned int mode) put_task_struct(task); if (!IS_ERR_OR_NULL(mm)) { - /* ensure this mm_struct can't be freed */ - mmgrab(mm); - /* but do not pin its memory */ - mmput(mm); + /* + * Prevent this interface from being used as a mean + * to bypass memory restrictions, including those + * imposed by LSMs. + */ + if (mm == current->mm && + f_mode & FMODE_WRITE) + mm = ERR_PTR(-EACCES); + else { + /* ensure this mm_struct can't be freed */ + mmgrab(mm); + /* but do not pin its memory */ + mmput(mm); + } } } @@ -785,7 +796,7 @@ struct mm_struct *proc_mem_open(struct inode *inode, unsigned int mode) static int __mem_open(struct inode *inode, struct file *file, unsigned int mode) { - struct mm_struct *mm = proc_mem_open(inode, mode); + struct mm_struct *mm = proc_mem_open(inode, mode, file->f_mode); if (IS_ERR(mm)) return PTR_ERR(mm); diff --git a/fs/proc/internal.h b/fs/proc/internal.h index 0f1692e..8d38cc7 100644 --- a/fs/proc/internal.h +++ b/fs/proc/internal.h @@ -275,7 +275,8 @@ struct proc_maps_private { #endif } __randomize_layout; -struct mm_struct *proc_mem_open(struct inode *inode, unsigned int mode); +struct mm_struct *proc_mem_open(struct inode *inode, unsigned int mode, + fmode_t f_mode); extern const struct file_operations proc_pid_maps_operations; extern const struct file_operations proc_tid_maps_operations; diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c index c486ad4..efb6535 100644 --- a/fs/proc/task_mmu.c +++ b/fs/proc/task_mmu.c @@ -227,7 +227,7 @@ static int proc_maps_open(struct inode *inode, struct file *file, return -ENOMEM; priv->inode = inode; - priv->mm = proc_mem_open(inode, PTRACE_MODE_READ); + priv->mm = proc_mem_open(inode, PTRACE_MODE_READ, file->f_mode); if (IS_ERR(priv->mm)) { int err = PTR_ERR(priv->mm); @@ -1534,7 +1534,7 @@ static int pagemap_open(struct inode *inode, struct file *file) { struct mm_struct *mm; - mm = proc_mem_open(inode, PTRACE_MODE_READ); + mm = proc_mem_open(inode, PTRACE_MODE_READ, file->f_mode); if (IS_ERR(mm)) return PTR_ERR(mm); file->private_data = mm; diff --git a/fs/proc/task_nommu.c b/fs/proc/task_nommu.c index 5b62f57..dc38516 100644 --- a/fs/proc/task_nommu.c +++ b/fs/proc/task_nommu.c @@ -280,7 +280,7 @@ static int maps_open(struct inode *inode, struct file *file, return -ENOMEM; priv->inode = inode; - priv->mm = proc_mem_open(inode, PTRACE_MODE_READ); + priv->mm = proc_mem_open(inode, PTRACE_MODE_READ, file->f_mode); if (IS_ERR(priv->mm)) { int err = PTR_ERR(priv->mm);