lkml.org 
[lkml]   [2021]   [Aug]   [14]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
Subject[PATCH 1/1] ima: check control characters in policy file path
Date
When a policy file path contains control characters like '\r' or '\b',
invalid error messages can be printed to overwrite system messages:

$ echo -e "/\rtest 12345678" > /sys/kernel/security/ima/policy

This patch rejects policy paths with control characters.

Signed-off-by: Tianxing Zhang <anakinzhang96@gmail.com>
---
security/integrity/ima/ima_fs.c | 9 +++++++++
1 file changed, 9 insertions(+)

diff --git a/security/integrity/ima/ima_fs.c b/security/integrity/ima/ima_fs.c
index 3d8e9d5db5aa..e6daa138de89 100644
--- a/security/integrity/ima/ima_fs.c
+++ b/security/integrity/ima/ima_fs.c
@@ -316,6 +316,7 @@ static ssize_t ima_write_policy(struct file *file, const char __user *buf,
{
char *data;
ssize_t result;
+ int i;

if (datalen >= PAGE_SIZE)
datalen = PAGE_SIZE - 1;
@@ -331,6 +332,14 @@ static ssize_t ima_write_policy(struct file *file, const char __user *buf,
goto out;
}

+ for (i = 0; data[i] != '\n' && data[i] != '\0'; i++) {
+ if (iscntrl(data[i])) {
+ pr_err_once("file path with no control characters required\n");
+ result = -EINVAL;
+ goto out_free;
+ }
+ }
+
result = mutex_lock_interruptible(&ima_write_mutex);
if (result < 0)
goto out_free;
--
2.25.1
\
 
 \ /
  Last update: 2021-08-14 10:28    [W:0.154 / U:0.032 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site