lkml.org 
[lkml]   [2009]   [Dec]   [31]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [RFC][PATCH v3] Unprivileged: Disable raising of privileges
    Quoting Eric W. Biederman (ebiederm@xmission.com):
    >
    > If we can know that a process will never raise
    > it's priveleges we can enable a lot of features
    > without privilege (such as unsharing namespaces
    > and unprivileged mounts) that otherwise would be unsafe,
    > because they could break assumptions of existing
    > suid executables.
    >
    > To allow this to be used as a sand boxing feature
    > also disable ptracing other executables without
    > this new restriction.
    >
    > For the moment I have used a per thread flag because
    > we are out of per process flags.
    >
    > To ensure all descendants get this flag I rely on
    > the default copying of procss structures.
    >
    > Added bprm->nosuid to make remove the need to add
    > duplicate error prone checks. This ensures that
    > the disabling of suid executables is exactly the
    > same as MNT_NOSUID.
    >
    > Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>
    > ---
    > arch/x86/include/asm/thread_info.h | 2 ++
    > fs/exec.c | 6 ++++--
    > include/linux/binfmts.h | 1 +
    > include/linux/prctl.h | 3 +++
    > kernel/ptrace.c | 4 ++++
    > kernel/sys.c | 21 +++++++++++++++++++++
    > security/commoncap.c | 3 +--
    > security/selinux/hooks.c | 2 +-
    > 8 files changed, 37 insertions(+), 5 deletions(-)
    >
    > diff --git a/arch/x86/include/asm/thread_info.h b/arch/x86/include/asm/thread_info.h
    > index 375c917..e716203 100644
    > --- a/arch/x86/include/asm/thread_info.h
    > +++ b/arch/x86/include/asm/thread_info.h
    > @@ -82,6 +82,7 @@ struct thread_info {
    > #define TIF_SYSCALL_EMU 6 /* syscall emulation active */
    > #define TIF_SYSCALL_AUDIT 7 /* syscall auditing active */
    > #define TIF_SECCOMP 8 /* secure computing */
    > +#define TIF_NOSUID 9 /* suid exec permanently disabled */
    > #define TIF_MCE_NOTIFY 10 /* notify userspace of an MCE */
    > #define TIF_USER_RETURN_NOTIFY 11 /* notify kernel of userspace return */
    > #define TIF_NOTSC 16 /* TSC is not accessible in userland */
    > @@ -107,6 +108,7 @@ struct thread_info {
    > #define _TIF_SYSCALL_EMU (1 << TIF_SYSCALL_EMU)
    > #define _TIF_SYSCALL_AUDIT (1 << TIF_SYSCALL_AUDIT)
    > #define _TIF_SECCOMP (1 << TIF_SECCOMP)
    > +#define _TIF_NOSUID (1 << TIF_NOSUID)
    > #define _TIF_MCE_NOTIFY (1 << TIF_MCE_NOTIFY)
    > #define _TIF_USER_RETURN_NOTIFY (1 << TIF_USER_RETURN_NOTIFY)
    > #define _TIF_NOTSC (1 << TIF_NOTSC)
    > diff --git a/fs/exec.c b/fs/exec.c
    > index 632b02e..5cba5ac 100644
    > --- a/fs/exec.c
    > +++ b/fs/exec.c
    > @@ -1131,8 +1131,10 @@ int prepare_binprm(struct linux_binprm *bprm)
    > /* clear any previous set[ug]id data from a previous binary */
    > bprm->cred->euid = current_euid();
    > bprm->cred->egid = current_egid();
    > -
    > - if (!(bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID)) {
    > + bprm->nosuid =
    > + (bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID) ||
    > + test_tsk_thread_flag(current, TIF_NOSUID);
    > + if (bprm->nosuid) {
    > /* Set-uid? */
    > if (mode & S_ISUID) {
    > bprm->per_clear |= PER_CLEAR_ON_SETID;
    > diff --git a/include/linux/binfmts.h b/include/linux/binfmts.h
    > index cd4349b..c3b5a30 100644
    > --- a/include/linux/binfmts.h
    > +++ b/include/linux/binfmts.h
    > @@ -44,6 +44,7 @@ struct linux_binprm{
    > #ifdef __alpha__
    > unsigned int taso:1;
    > #endif
    > + unsigned int nosuid:1; /* True if suid bits are ignored */
    > unsigned int recursion_depth;
    > struct file * file;
    > struct cred *cred; /* new credentials */
    > diff --git a/include/linux/prctl.h b/include/linux/prctl.h
    > index a3baeb2..8adc517 100644
    > --- a/include/linux/prctl.h
    > +++ b/include/linux/prctl.h
    > @@ -102,4 +102,7 @@
    >
    > #define PR_MCE_KILL_GET 34
    >
    > +#define PR_SET_NOSUID 35
    > +#define PR_GET_NOSUID 36
    > +
    > #endif /* _LINUX_PRCTL_H */
    > diff --git a/kernel/ptrace.c b/kernel/ptrace.c
    > index 23bd09c..b91040c 100644
    > --- a/kernel/ptrace.c
    > +++ b/kernel/ptrace.c
    > @@ -152,6 +152,10 @@ int __ptrace_may_access(struct task_struct *task, unsigned int mode)
    > if (!dumpable && !capable(CAP_SYS_PTRACE))
    > return -EPERM;
    >
    > + if (test_tsk_thread_flag(current, TIF_NOSUID) &&
    > + !test_tsk_thread_flag(task, TIF_NOSUID))
    > + return -EPERM;
    > +
    > return security_ptrace_access_check(task, mode);
    > }
    >
    > diff --git a/kernel/sys.c b/kernel/sys.c
    > index 26a6b73..8731f2a 100644
    > --- a/kernel/sys.c
    > +++ b/kernel/sys.c
    > @@ -1578,6 +1578,27 @@ SYSCALL_DEFINE5(prctl, int, option, unsigned long, arg2, unsigned long, arg3,
    > else
    > error = PR_MCE_KILL_DEFAULT;
    > break;
    > + case PR_SET_NOSUID:
    > + {
    > + const struct cred *cred = current->cred;
    > + error = -EINVAL;
    > + /* Don't support cases that could be unsafe */
    > + if ( (cred->uid != cred->suid) ||
    > + (cred->uid != cred->euid) ||
    > + (cred->uid != cred->fsuid) ||
    > + (cred->gid != cred->sgid) ||
    > + (cred->gid != cred->egid) ||
    > + (cred->gid != cred->fsgid) ||
    > + !cap_isclear(cred->cap_permitted) ||
    > + (atomic_read(&current->signal->count) != 1))
    > + break;
    > + error = 0;
    > + set_tsk_thread_flag(current, TIF_NOSUID);
    > + break;
    > + }
    > + case PR_GET_NOSUID:
    > + error = !!test_tsk_thread_flag(current, TIF_NOSUID);
    > + break;
    > default:
    > error = -EINVAL;
    > break;
    > diff --git a/security/commoncap.c b/security/commoncap.c
    > index f800fdb..34500e3 100644
    > --- a/security/commoncap.c
    > +++ b/security/commoncap.c
    > @@ -389,7 +389,7 @@ static int get_file_caps(struct linux_binprm *bprm, bool *effective)
    > if (!file_caps_enabled)
    > return 0;
    >
    > - if (bprm->file->f_vfsmnt->mnt_flags & MNT_NOSUID)
    > + if (bprm->nosuid)
    > return 0;

    I'm sorry, this may actually not be sufficient.

    Could you try the following test on a kernel with this patch? :

    1. become root
    2. do prctl(PR_SET_NOSUID);
    3. run bash, and examine your capabilities in /proc/self/status

    I think the code in security/commoncap.c:457-458 will re-raise your
    capabilities.

    >
    > dentry = dget(bprm->file->f_dentry);
    > @@ -868,7 +868,6 @@ int cap_task_prctl(int option, unsigned long arg2, unsigned long arg3,
    > else
    > new->securebits &= ~issecure_mask(SECURE_KEEP_CAPS);
    > goto changed;
    > -
    > default:
    > /* No functionality available - continue with default */
    > error = -ENOSYS;
    > diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
    > index 7a374c2..bd77a2b 100644
    > --- a/security/selinux/hooks.c
    > +++ b/security/selinux/hooks.c
    > @@ -2147,7 +2147,7 @@ static int selinux_bprm_set_creds(struct linux_binprm *bprm)
    > COMMON_AUDIT_DATA_INIT(&ad, FS);
    > ad.u.fs.path = bprm->file->f_path;
    >
    > - if (bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID)
    > + if (bprm->nosuid)
    > new_tsec->sid = old_tsec->sid;
    >
    > if (new_tsec->sid == old_tsec->sid) {
    > --
    > 1.6.5.2.143.g8cc62
    >
    > --
    > To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
    > the body of a message to majordomo@vger.kernel.org
    > More majordomo info at http://vger.kernel.org/majordomo-info.html


    \
     
     \ /
      Last update: 2009-12-31 16:27    [W:5.537 / U:0.100 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site