Ryan Mallon
312b4e2269
vsprintf: check real user/group id for %pK ...
Some setuid binaries will allow reading of files which have read
permission by the real user id. This is problematic with files which
use %pK because the file access permission is checked at open() time,
but the kptr_restrict setting is checked at read() time. If a setuid
binary opens a %pK file as an unprivileged user, and then elevates
permissions before reading the file, then kernel pointer values may be
leaked.
This happens for example with the setuid pppd application on Ubuntu 12.04:
$ head -1 /proc/kallsyms
00000000 T startup_32
$ pppd file /proc/kallsyms
pppd: In file /proc/kallsyms: unrecognized option 'c1000000'
This will only leak the pointer value from the first line, but other
setuid binaries may leak more information.
Fix this by adding a check that in addition to the current process having
CAP_SYSLOG, that effective user and group ids are equal to the real ids.
If a setuid binary reads the contents of a file which uses %pK then the
pointer values will be printed as NULL if the real user is unprivileged.
Update the sysctl documentation to reflect the changes, and also correct
the documentation to state the kptr_restrict=0 is the default.
This is a only temporary solution to the issue. The correct solution is
to do the permission check at open() time on files, and to replace %pK
with a function which checks the open() time permission. %pK uses in
printk should be removed since no sane permission check can be done, and
instead protected by using dmesg_restrict.
Signed-off-by: Ryan Mallon <rmallon@gmail.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Alexander Viro <viro@zeniv.linux.org.uk>
Cc: Joe Perches <joe@perches.com>
Cc: "Eric W. Biederman" <ebiederm@xmission.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2013-11-13 12:09:14 +09:00
lib: Move fonts from drivers/video/console/ to lib/fonts/
2013-06-28 10:28:22 +02:00
lz4: fix compression/decompression signedness mismatch
2013-09-11 15:59:45 -07:00
lib/lzo: Update LZO compression to current upstream version
2013-02-20 19:36:01 +01:00
alpha: Modernize lib/mpi/longlong.h
2013-07-19 13:54:23 -07:00
md update for v3.12
2013-09-10 13:03:41 -07:00
decompressors: fix typo "POWERPC"
2013-03-13 15:21:48 -07:00
zlib: slim down zlib_deflate() workspace when possible
2011-03-22 17:44:17 -07:00
X.509: Implement simple static OID registry
2012-10-08 13:50:18 +10:30
argv_split(): teach it to handle mutable strings
2013-04-29 18:28:19 -07:00
Nothing all that exciting; a new module-from-fd syscall for those who want
2012-12-19 07:55:08 -08:00
lib: atomic64: Initialize locks statically to fix early users
2012-12-20 13:50:16 -08:00
atomic64_test: simplify the #ifdef for atomic64_dec_if_positive() test
2012-07-30 17:25:16 -07:00
audit: support the "standard" <asm-generic/unistd.h>
2011-05-04 14:41:28 -04:00
lib: reduce the use of module.h wherever possible
2012-03-07 15:04:04 -05:00
usb/core: use bin2bcd() for bcdDevice in RH
2012-09-10 11:13:16 -07:00
propagate name change to comments in kernel source
2012-12-06 10:39:54 +01:00
lib: reduce the use of module.h wherever possible
2012-03-07 15:04:04 -05:00
btree: catch NULL value before it does harm
2012-06-07 14:43:55 -07:00
taint: add explicit flag to show whether lock dep is still OK.
2013-01-21 17:17:57 +10:30
X.509: do not emit any informational output
2013-06-19 17:54:06 +02:00
printk: Provide a wake_up_klogd() off-case
2013-03-22 16:41:20 -07:00
lib: reduce the use of module.h wherever possible
2012-03-07 15:04:04 -05:00
asm-generic headers: Allow yet more arch overrides in checksum.h
2013-02-11 20:00:33 +05:30
lib: add weak clz/ctz functions
2013-07-09 10:33:30 -07:00
lib: Fix multiple definitions of clz_tab
2012-02-02 10:34:23 +11:00
lib: reduce the use of module.h wherever possible
2012-03-07 15:04:04 -05:00
Docs: wording: functions -> algorithm
2011-10-29 21:20:22 +02:00
cpu: rewrite cpu-notifier-error-inject module
2012-07-30 17:25:22 -07:00
Remove GENERIC_HARDIRQ config option
2013-09-13 15:09:52 +02:00
bootmem: fix wrong call parameter for free_bootmem()
2012-12-11 17:22:28 -08:00
crypto: crct10dif - Add fallback for broken initrds
2013-09-12 15:31:34 +10:00
lib: crc8: add new library module providing crc8 algorithm
2011-06-03 15:01:06 -04:00
lib/crc32: update the comments of crc32_{be,le}_generic()
2013-09-11 15:58:38 -07:00
crc32: select an algorithm via Kconfig
2012-03-23 16:58:38 -07:00
lib: reduce the use of module.h wherever possible
2012-03-07 15:04:04 -05:00
mutex: Add support for wound/wait style locks
2013-06-26 12:10:56 +02:00
debugobjects: Make debug_object_activate() return status
2013-08-18 17:39:55 -07:00
lib: reduce the use of module.h wherever possible
2012-03-07 15:04:04 -05:00
lib: add support for LZ4-compressed kernel
2013-07-09 10:33:30 -07:00
decompress_bunzip2: remove invalid vi modeline
2011-12-06 10:00:05 +01:00
lib/decompressors: fix "no limit" output buffer length
2013-09-11 15:58:38 -07:00
lib: add support for LZ4-compressed kernel
2013-07-09 10:33:30 -07:00
treewide: Fix comment and string typo 'bufer'
2011-12-06 09:53:40 +01:00
lib/lzo: Rename lzo1x_decompress.c to lzo1x_decompress_safe.c
2013-02-20 19:36:00 +01:00
Fix common misspellings
2011-03-31 11:26:23 -03:00
lib/devres.c: fix misplaced #endif
2013-02-27 19:10:09 -08:00
Merge branch 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security
2013-02-21 08:18:12 -08:00
math64: New separate div64_u64_rem helper
2013-08-23 09:02:14 -04:00
dma-debug: update DMA debug API to better handle multiple mappings of a buffer
2013-03-22 16:41:20 -07:00
x86, asmlinkage: Make dump_stack visible
2013-08-06 14:21:01 -07:00
dynamic debug: line queries failing due to uninitialized local variable
2013-08-28 12:10:53 -07:00
bql: Avoid possible inconsistent calculation.
2012-05-31 18:18:17 -04:00
earlycpio.c: Fix the confusing comment of find_cpio_data().
2013-08-14 23:24:01 +02:00
debugfs: add get/set for atomic types
2013-06-03 13:55:01 -07:00
of/lib: Allow scripts/dtc/libfdt to be used from kernel code
2012-07-23 13:54:52 +01:00
of/lib: Allow scripts/dtc/libfdt to be used from kernel code
2012-07-23 13:54:52 +01:00
of/lib: Allow scripts/dtc/libfdt to be used from kernel code
2012-07-23 13:54:52 +01:00
of/lib: Allow scripts/dtc/libfdt to be used from kernel code
2012-07-23 13:54:52 +01:00
of/lib: Allow scripts/dtc/libfdt to be used from kernel code
2012-07-23 13:54:52 +01:00
of/lib: Allow scripts/dtc/libfdt to be used from kernel code
2012-07-23 13:54:52 +01:00
lib: reduce the use of module.h wherever possible
2012-03-07 15:04:04 -05:00
lib: reduce the use of module.h wherever possible
2012-03-07 15:04:04 -05:00
lib: reduce the use of module.h wherever possible
2012-03-07 15:04:04 -05:00
lib/flex_proportions.c: fix corruption of denominator in flexible proportions
2012-09-25 08:59:21 -07:00
lib/gcd.c: prevent possible div by 0
2012-10-06 03:04:57 +09:00
sections: fix const sections for crc32 table
2012-10-06 03:04:46 +09:00
lib/genalloc.c: correct dev_get_gen_pool documentation
2013-09-11 15:58:38 -07:00
lib: reduce the use of module.h wherever possible
2012-03-07 15:04:04 -05:00
lib: introduce upper case hex ascii helpers
2013-09-20 15:38:26 -04:00
lib: reduce the use of module.h wherever possible
2012-03-07 15:04:04 -05:00
idr: print a stack dump after ida_remove warning
2013-07-03 16:08:04 -07:00
lib/int_sqrt.c: optimize square root algorithm
2013-04-29 18:28:19 -07:00
mm: interval tree updates
2012-10-09 16:22:40 +09:00
random32: rename random32 to prandom
2012-12-17 17:15:26 -08:00
lib: reduce the use of module.h wherever possible
2012-03-07 15:04:04 -05:00
lib: reduce the use of module.h wherever possible
2012-03-07 15:04:04 -05:00
The following text was taken from the original review request:
2012-03-24 10:24:31 -07:00
lib: reduce the use of module.h wherever possible
2012-03-07 15:04:04 -05:00
Hoist memcpy_fromiovec/memcpy_toiovec into lib/
2013-05-20 10:24:22 +09:30
lib: reduce the use of module.h wherever possible
2012-03-07 15:04:04 -05:00
ddr: add LPDDR2 data from JESD209-2
2012-05-02 00:04:06 -07:00
lib/kasprintf.c: use kmalloc_track_caller() to get accurate traces for kvasprintf
2012-10-11 08:50:15 +09:00
Merge git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6
2013-09-07 14:31:18 -07:00
percpu: add test module for various percpu operations
2013-11-13 12:09:11 +09:00
treewide: Fix typo in printk
2013-06-18 13:48:45 +02:00
kfifo: fix kfifo_alloc() and kfifo_init()
2013-02-27 19:10:23 -08:00
klist: del waiter from klist_remove_waiters before wakeup waitting process
2013-05-21 10:16:39 -07:00
Revert "sysfs: drop kobj_ns_type handling"
2013-11-07 20:47:28 +09:00
netlink: hide struct module parameter in netlink_kernel_create
2012-09-08 18:46:30 -04:00
kstrto*: add documentation
2012-12-17 17:15:22 -08:00
lib/kstrtox: common code between kstrto*() and simple_strto*() functions
2011-10-31 17:30:56 -07:00
lib: reduce the use of module.h wherever possible
2012-03-07 15:04:04 -05:00
rcu: Fix broken strings in RCU's source code.
2012-07-06 06:01:49 -07:00
lib/: rename random32() to prandom_u32()
2013-04-29 18:28:42 -07:00
llist: fix/simplify llist_add() and llist_add_batch()
2013-07-13 13:29:24 +04:00
sched: Introduce preempt_count accessor functions
2013-09-25 14:07:32 +02:00
The main feature of interest this time is quota updates. There are
2013-11-11 07:11:00 +09:00
lru_cache: introduce lc_get_cumulative()
2013-03-22 22:17:36 -06:00
percpu: add test module for various percpu operations
2013-11-13 12:09:11 +09:00
lib: reduce the use of module.h wherever possible
2012-03-07 15:04:04 -05:00
memory: memory notifier error injection module
2012-07-30 17:25:22 -07:00
string: introduce memweight()
2012-07-30 17:25:16 -07:00
net: core: move mac_pton() to lib/net_utils.c
2013-06-05 12:00:27 -07:00
netlink: add minlen validation for the new signed types
2012-08-30 13:11:46 -04:00
mode_t, whack-a-mole at 11...
2013-04-09 14:13:05 -04:00
fault-injection: notifier error injection
2012-07-30 17:25:22 -07:00
powerpc+of: Rename and fix OF reconfig notifier error inject module
2012-12-14 10:32:52 +11:00
Give the OID registry file module info to avoid kernel tainting
2013-05-05 14:38:00 -07:00
lib/parser.c: fix up comments for valid return values from match_number
2013-02-21 17:22:25 -08:00
lib: add NO_GENERIC_PCI_IOPORT_MAP
2012-01-31 23:19:47 +02:00
percpu_refcount: export symbols
2013-10-16 21:35:53 -07:00
percpu_rw_semaphore: add lockdep annotations
2012-12-17 17:15:18 -08:00
kernel: delete __cpuinit usage from all core kernel files
2013-07-14 19:36:59 -04:00
idr: Percpu ida
2013-09-09 14:29:15 -07:00
percpu: add test module for various percpu operations
2013-11-13 12:09:11 +09:00
lib/plist.c: make plist test announcements KERN_DEBUG
2012-10-06 03:04:58 +09:00
PM: PM notifier error injection module
2012-07-30 17:25:22 -07:00
locking, lib/proportions: Annotate prop_local_percpu::lock as raw
2011-09-13 11:11:50 +02:00
lib/radix-tree.c: make radix_tree_node_alloc() work correctly within interrupt
2013-09-11 15:59:36 -07:00
prandom: introduce prandom_bytes() and prandom_bytes_state()
2012-12-17 17:15:26 -08:00
lib: reduce the use of module.h wherever possible
2012-03-07 15:04:04 -05:00
lib: Change mail address of Oskar Schirmer
2012-05-17 15:18:37 +02:00
rbtree: add postorder iteration functions
2013-09-11 15:59:19 -07:00
rbtree_test: add test for postorder iteration
2013-09-11 15:59:20 -07:00
sch_red: Adaptative RED AQM
2011-12-08 19:52:43 -05:00
rwsem: simplify __rwsem_do_wake
2013-05-07 07:20:16 -07:00
rwsem: check counter to avoid cmpxchg calls
2013-05-07 16:11:51 -07:00
lib/scatterlist.c: don't flush_kernel_dcache_page on slab page
2013-10-31 16:58:13 -07:00
lib: reduce the use of module.h wherever possible
2012-03-07 15:04:04 -05:00
mm: do not walk all of system memory during show_mem
2013-11-13 12:09:09 +09:00
sched: Introduce preempt_count accessor functions
2013-09-25 14:07:32 +02:00
lib/spinlock_debug: avoid livelock in do_raw_spin_lock()
2012-10-06 03:04:57 +09:00
lib: add support for stmp-style devices
2012-04-20 23:27:08 +02:00
The following text was taken from the original review request:
2012-03-24 10:24:31 -07:00
lib/string_helpers: introduce generic string_unescape
2013-04-30 17:04:03 -07:00
word-at-a-time: make the interfaces truly generic
2012-05-26 11:33:40 -07:00
lib: Fix generic strnlen_user for 32-bit big-endian machines
2012-05-27 20:59:46 -07:00
swiotlb: replace dma_length with sg_dma_len() macro
2013-08-09 11:28:42 -04:00
lib: reduce the use of module.h wherever possible
2012-03-07 15:04:04 -05:00
lib/test-kstrtox.c: mark const init data with __initconst instead of __initdata
2012-05-29 16:22:32 -07:00
lib/string_helpers: introduce generic string_unescape
2013-04-30 17:04:03 -07:00
The following text was taken from the original review request:
2012-03-24 10:24:31 -07:00
Move utf16 functions to kernel core and rename
2013-04-15 21:23:03 +01:00
Kconfig: consolidate CONFIG_DEBUG_STRICT_USER_COPY_CHECKS
2013-04-30 17:04:09 -07:00
uuid: use prandom_bytes()
2013-04-29 18:28:42 -07:00
vsprintf: check real user/group id for %pK
2013-11-13 12:09:14 +09:00
312b4e2269