Oleg Nesterov
1f3aa3e028
ipc/mqueue.c: change __do_notify() to bypass check_kill_permission()
commit b5f2006144c6ae941726037120fa1001ddede784 upstream.
Commit cc731525f2 ("signal: Remove kernel interal si_code magic")
changed the value of SI_FROMUSER(SI_MESGQ), this means that mq_notify() no
longer works if the sender doesn't have rights to send a signal.
Change __do_notify() to use do_send_sig_info() instead of kill_pid_info()
to avoid check_kill_permission().
This needs the additional notify.sigev_signo != 0 check, shouldn't we
change do_mq_notify() to deny sigev_signo == 0 ?
Test-case:
#include <signal.h>
#include <mqueue.h>
#include <unistd.h>
#include <sys/wait.h>
#include <assert.h>
static int notified;
static void sigh(int sig)
{
notified = 1;
}
int main(void)
{
signal(SIGIO, sigh);
int fd = mq_open("/mq", O_RDWR|O_CREAT, 0666, NULL);
assert(fd >= 0);
struct sigevent se = {
.sigev_notify = SIGEV_SIGNAL,
.sigev_signo = SIGIO,
};
assert(mq_notify(fd, &se) == 0);
if (!fork()) {
assert(setuid(1) == 0);
mq_send(fd, "",1,0);
return 0;
}
wait(NULL);
mq_unlink("/mq");
assert(notified);
return 0;
}
[manfred@colorfullife.com: 1) Add self_exec_id evaluation so that the implementation matches do_notify_parent 2) use PIDTYPE_TGID everywhere]
Fixes: cc731525f2 ("signal: Remove kernel interal si_code magic")
Reported-by: Yoji <yoji.fujihar.min@gmail.com>
Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: Manfred Spraul <manfred@colorfullife.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Acked-by: "Eric W. Biederman" <ebiederm@xmission.com>
Cc: Davidlohr Bueso <dave@stgolabs.net>
Cc: Markus Elfring <elfring@users.sourceforge.net>
Cc: <1vier1@web.de>
Cc: <stable@vger.kernel.org>
Link: http://lkml.kernel.org/r/e2a782e4-eab9-4f5c-c749-c07a8f7a4e66@colorfullife.com
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
2020-05-14 07:58:26 +02:00 |
| .. |
|
compat.c
|
|
|
|
ipc_sysctl.c
|
proc/sysctl: add shared variables for range check
|
2019-07-18 17:08:07 -07:00 |
|
Makefile
|
|
|
|
mq_sysctl.c
|
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 441
|
2019-06-05 17:37:17 +02:00 |
|
mqueue.c
|
ipc/mqueue.c: change __do_notify() to bypass check_kill_permission()
|
2020-05-14 07:58:26 +02:00 |
|
msg.c
|
ipc/msg.c: consolidate all xxxctl_down() functions
|
2020-02-11 04:35:07 -08:00 |
|
msgutil.c
|
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 52
|
2019-05-24 17:36:42 +02:00 |
|
namespace.c
|
ipc: Convert mqueue fs to fs_context
|
2019-02-28 03:29:29 -05:00 |
|
sem.c
|
Revert "ipc,sem: remove uneeded sem_undo_list lock usage in exit_sem()"
|
2020-02-28 17:22:20 +01:00 |
|
shm.c
|
ipc: rename old-style shmctl/semctl/msgctl syscalls
|
2019-01-25 17:22:50 +01:00 |
|
syscall.c
|
ipc: rename old-style shmctl/semctl/msgctl syscalls
|
2019-01-25 17:22:50 +01:00 |
|
util.c
|
ipc/util.c: sysvipc_find_ipc() should increase position index
|
2020-04-29 16:33:00 +02:00 |
|
util.h
|
ipc: fix sparc64 ipc() wrapper
|
2019-09-07 21:42:25 +02:00 |