Repository files (latest commit first)

Filename	Latest commit message	Latest commit date
Kees Cook a068acf2ee fs: create and use seq_show_option for escaping ... Many file systems that implement the show_options hook fail to correctly escape their output which could lead to unescaped characters (e.g. new lines) leaking into /proc/mounts and /proc/[pid]/mountinfo files. This could lead to confusion, spoofed entries (resulting in things like systemd issuing false d-bus "mount" notifications), and who knows what else. This looks like it would only be the root user stepping on themselves, but it's possible weird things could happen in containers or in other situations with delegated mount privileges. Here's an example using overlay with setuid fusermount trusting the contents of /proc/mounts (via the /etc/mtab symlink). Imagine the use of "sudo" is something more sneaky: $ BASE="ovl" $ MNT="$BASE/mnt" $ LOW="$BASE/lower" $ UP="$BASE/upper" $ WORK="$BASE/work/ 0 0 none /proc fuse.pwn user_id=1000" $ mkdir -p "$LOW" "$UP" "$WORK" $ sudo mount -t overlay -o "lowerdir=$LOW,upperdir=$UP,workdir=$WORK" none /mnt $ cat /proc/mounts none /root/ovl/mnt overlay rw,relatime,lowerdir=ovl/lower,upperdir=ovl/upper,workdir=ovl/work/ 0 0 none /proc fuse.pwn user_id=1000 0 0 $ fusermount -u /proc $ cat /proc/mounts cat: /proc/mounts: No such file or directory This fixes the problem by adding new seq_show_option and seq_show_option_n helpers, and updating the vulnerable show_option handlers to use them as needed. Some, like SELinux, need to be open coded due to unusual existing escape mechanisms. [akpm@linux-foundation.org: add lost chunk, per Kees] [keescook@chromium.org: seq_show_option should be using const parameters] Signed-off-by: Kees Cook <keescook@chromium.org> Acked-by: Serge Hallyn <serge.hallyn@canonical.com> Acked-by: Jan Kara <jack@suse.com> Acked-by: Paul Moore <paul@paul-moore.com> Cc: J. R. Okajima <hooanon05g@gmail.com> Signed-off-by: Kees Cook <keescook@chromium.org> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>		2015-09-04 16:54:41 -07:00
..
bpf	bpf: fix bpf_perf_event_read() loop upper bound	2015-08-12 16:42:50 -07:00
configs	kconfig: add xenconfig defconfig helper	2015-06-16 11:04:29 +01:00
debug	debug: prevent entering debug mode on panic/exception.	2015-02-19 12:39:03 -06:00
events	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next	2015-09-03 08:08:17 -07:00
gcov	gcov: add support for GCC 5.1	2015-06-30 19:44:57 -07:00
irq	Merge branch 'irq-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2015-09-01 14:33:35 -07:00
livepatch	livepatch: Improve error handling in klp_disable_func()	2015-07-14 22:48:06 +02:00
locking	locking/qrwlock: Make use of _{acquire|release|relaxed}() atomics	2015-08-12 11:59:06 +02:00
power	Merge branch 'for-4.3/core' of git://git.kernel.dk/linux-block	2015-09-02 13:10:25 -07:00
printk	printk: improve the description of /dev/kmsg line format	2015-06-30 19:44:59 -07:00
rcu	rcu,locking: Privatize smp_mb__after_unlock_lock()	2015-08-04 08:49:21 -07:00
sched	Merge branch 'locking-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2015-09-03 15:46:07 -07:00
time	Merge branch 'timers-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2015-09-01 14:04:50 -07:00
trace	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next	2015-09-03 08:08:17 -07:00
.gitignore
acct.c	acct: check FMODE_CAN_WRITE	2015-04-11 22:27:55 -04:00
async.c
audit.c	Merge branch 'upstream' of git://git.infradead.org/users/pcmoore/audit	2015-06-27 13:53:16 -07:00
audit.h	Merge branch 'upstream' of git://git.infradead.org/users/pcmoore/audit	2015-04-22 14:49:23 -07:00
audit_tree.c	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2015-04-26 17:22:07 -07:00
audit_watch.c	VFS: audit: d_backing_inode() annotations	2015-04-15 15:06:55 -04:00
auditfilter.c	Merge branch 'upstream' of git://git.infradead.org/users/pcmoore/audit	2015-02-11 20:07:47 -08:00
auditsc.c	Fix broken audit tests for exec arg len	2015-07-08 09:33:38 -07:00
backtracetest.c
bounds.c
capability.c	kernel: conditionally support non-root users, groups and capabilities	2015-04-15 16:35:22 -07:00
cgroup.c	fs: create and use seq_show_option for escaping	2015-09-04 16:54:41 -07:00
cgroup_freezer.c	cgroup: allow a cgroup subsystem to reject a fork	2015-07-14 17:29:23 -04:00
cgroup_pids.c	cgroup: pids: fix invalid get/put usage	2015-08-25 14:19:25 -04:00
compat.c	compat: cleanup coding in compat_get_bitmap() and compat_put_bitmap()	2015-06-04 23:57:18 +02:00
configs.c
context_tracking.c	context_tracking: Inherit TIF_NOHZ through forks instead of context switches	2015-05-07 12:02:51 +02:00
cpu.c	Merge branch 'sched-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2015-08-31 20:26:22 -07:00
cpu_pm.c
cpuset.c	cpuset: use trialcs->mems_allowed as a temp variable	2015-08-10 11:18:41 -04:00
crash_dump.c
cred.c	kernel: conditionally support non-root users, groups and capabilities	2015-04-15 16:35:22 -07:00
delayacct.c
dma.c
elfcore.c
exec_domain.c	Remove rest of exec domains.	2015-04-12 21:03:31 +02:00
exit.c	kernel: exit: fix typo in comment	2015-08-07 13:59:49 +02:00
extable.c
fork.c	Merge branch 'for-4.3' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup	2015-09-02 08:04:23 -07:00
freezer.c
futex.c	futex: Make should_fail_futex() static	2015-07-20 21:43:54 +02:00
futex_compat.c
groups.c	kernel: conditionally support non-root users, groups and capabilities	2015-04-15 16:35:22 -07:00
hung_task.c	kernel/hung_task.c: change hung_task.c to use for_each_process_thread()	2015-04-15 16:35:22 -07:00
irq_work.c
jump_label.c	locking/static_keys: Add selftest	2015-08-03 11:34:16 +02:00
kallsyms.c
kcmp.c
Kconfig.freezer
Kconfig.hz
Kconfig.locks	locking/qrwlock: Rename QUEUE_RWLOCK to QUEUED_RWLOCKS	2015-05-12 09:46:00 +02:00
Kconfig.preempt
kexec.c	kernel/panic/kexec: fix "crash_kexec_post_notifiers" option issue in oops path	2015-06-30 19:44:57 -07:00
kmod.c
kprobes.c	perf/x86/hw_breakpoints: Disallow kernel breakpoints unless kprobe-safe	2015-08-04 10:16:54 +02:00
ksysfs.c
kthread.c	kernel/kthread.c:kthread_create_on_node(): clarify documentation	2015-09-04 16:54:41 -07:00
latencytop.c
Makefile	cgroup: implement the PIDs subsystem	2015-07-14 17:29:23 -04:00
module-internal.h
module.c	module: weaken locking assertion for oops path.	2015-07-29 06:13:22 +09:30
module_signing.c
notifier.c	Merge branch 'x86-asm-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2015-09-01 08:40:25 -07:00
nsproxy.c
padata.c	padata: use %*pb[l] to print bitmaps including cpumasks and nodemasks	2015-02-13 21:21:38 -08:00
panic.c	kernel/panic/kexec: fix "crash_kexec_post_notifiers" option issue in oops path	2015-06-30 19:44:57 -07:00
params.c	Minor merge needed, due to function move.	2015-07-01 10:49:25 -07:00
pid.c	rcu: Rename rcu_lockdep_assert() to RCU_LOCKDEP_WARN()	2015-07-22 15:27:32 -07:00
pid_namespace.c
profile.c	profile: use %*pb[l] to print bitmaps including cpumasks and nodemasks	2015-02-13 21:21:38 -08:00
ptrace.c	ptrace: ptrace_detach() can no longer race with SIGKILL	2015-04-17 09:04:06 -04:00
range.c
reboot.c	kernel/reboot.c: add orderly_reboot for graceful reboot	2015-04-15 16:35:23 -07:00
relay.c	kernel/relay.c: use kvfree() in relay_free_page_array()	2015-06-30 19:44:59 -07:00
resource.c	mm: Fix bugs in region_is_ram()	2015-07-22 17:20:34 +02:00
seccomp.c	seccomp, filter: add and use bpf_prog_create_from_user from seccomp	2015-05-09 17:35:05 -04:00
signal.c	signal: fix information leak in copy_siginfo_to_user	2015-08-07 04:39:40 +03:00
smp.c	smp: Fix error case handling in smp_call_function_*()	2015-04-19 13:19:23 -07:00
smpboot.c	watchdog: add watchdog_cpumask sysctl to assist nohz	2015-06-24 17:49:40 -07:00
smpboot.h
softirq.c
stacktrace.c
stop_machine.c	stop_machine: Remove cpu_stop_work's from list in cpu_stop_park()	2015-08-03 12:21:28 +02:00
sys.c	vfs: Commit to never having exectuables on proc and sysfs.	2015-07-10 10:39:25 -05:00
sys_ni.c	x86/ldt: Make modify_ldt() optional	2015-07-31 13:30:45 +02:00
sysctl.c	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace	2015-07-03 15:20:57 -07:00
sysctl_binary.c
system_certificates.S
system_keyring.c
task_work.c
taskstats.c
test_kprobes.c
torture.c	rcu: Convert ACCESS_ONCE() to READ_ONCE() and WRITE_ONCE()	2015-05-27 12:56:15 -07:00
tracepoint.c
tsacct.c
uid16.c
up.c
user-return-notifier.c
user.c
user_namespace.c	capabilities: ambient capabilities	2015-09-04 16:54:41 -07:00
utsname.c
utsname_sysctl.c
watchdog.c	watchdog: add watchdog_cpumask sysctl to assist nohz	2015-06-24 17:49:40 -07:00
workqueue.c	Merge branch 'for-4.3' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq	2015-09-02 08:02:20 -07:00
workqueue_internal.h