Kees Cook
f4aacea2f5
sysctl: allow for strict write position handling ...
When writing to a sysctl string, each write, regardless of VFS position,
begins writing the string from the start. This means the contents of
the last write to the sysctl controls the string contents instead of the
first:
open("/proc/sys/kernel/modprobe", O_WRONLY) = 1
write(1, "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"..., 4096) = 4096
write(1, "/bin/true", 9) = 9
close(1) = 0
$ cat /proc/sys/kernel/modprobe
/bin/true
Expected behaviour would be to have the sysctl be "AAAA..." capped at
maxlen (in this case KMOD_PATH_LEN: 256), instead of truncating to the
contents of the second write. Similarly, multiple short writes would
not append to the sysctl.
The old behavior is unlike regular POSIX files enough that doing audits
of software that interact with sysctls can end up in unexpected or
dangerous situations. For example, "as long as the input starts with a
trusted path" turns out to be an insufficient filter, as what must also
happen is for the input to be entirely contained in a single write
syscall -- not a common consideration, especially for high level tools.
This provides kernel.sysctl_writes_strict as a way to make this behavior
act in a less surprising manner for strings, and disallows non-zero file
position when writing numeric sysctls (similar to what is already done
when reading from non-zero file positions). For now, the default (0) is
to warn about non-zero file position use, but retain the legacy
behavior. Setting this to -1 disables the warning, and setting this to
1 enables the file position respecting behavior.
[akpm@linux-foundation.org: fix build]
[akpm@linux-foundation.org: move misplaced hunk, per Randy]
Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: Randy Dunlap <rdunlap@infradead.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2014-06-06 16:08:13 -07:00
kernel/printk: use symbolic defines for console loglevels
2014-06-04 16:54:17 -07:00
Merge branch 'for-linus' of git://ftp.arm.linux.org.uk/~rmk/linux-arm into next
2014-06-05 15:57:04 -07:00
genirq: Improve documentation to match current implementation
2014-05-27 10:16:44 +02:00
Merge branch 'sched-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip into next
2014-06-03 14:00:15 -07:00
Merge branches 'pnp', 'powercap', 'pm-runtime' and 'pm-opp'
2014-06-03 23:13:00 +02:00
kernel/printk: use symbolic defines for console loglevels
2014-06-04 16:54:17 -07:00
Merge branch 'locking-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip into next
2014-06-03 12:57:53 -07:00
printk: Add printk_deferred_once
2014-06-04 16:54:17 -07:00
Merge branch 'akpm' (patchbomb from Andrew) into next
2014-06-04 16:55:13 -07:00
tracing: Use rcu_dereference_sched() for trace event triggers
2014-05-02 23:12:42 -04:00
net: Use netlink_ns_capable to verify the permisions of netlink messages
2014-04-24 13:44:54 -04:00
audit: Use struct net not pid_t to remember the network namespce to reply in
2014-03-20 10:10:53 -04:00
inotify: Fix reporting of cookies for inotify events
2014-02-18 11:17:17 +01:00
inotify: Fix reporting of cookies for inotify events
2014-02-18 11:17:17 +01:00
Merge git://git.infradead.org/users/eparis/audit
2014-04-12 12:38:53 -07:00
Merge git://git.infradead.org/users/eparis/audit
2014-04-12 12:38:53 -07:00
kernel/backtracetest.c: replace no level printk by pr_info()
2014-06-04 16:54:14 -07:00
kernel/capability.c: code clean-up
2014-06-04 16:54:15 -07:00
kernfs: move the last knowledge of sysfs out from kernfs
2014-05-27 14:33:17 -07:00
cgroup: fix rcu_read_lock() leak in update_if_frozen()
2014-05-13 11:28:30 -04:00
kernel/compat.c: use sizeof() instead of sizeof
2014-06-04 16:54:19 -07:00
asmlinkage: Add explicit __visible to drivers/*, lib/*, kernel/*
2014-05-05 16:07:46 -07:00
kernel/cpu.c: convert printk to pr_foo()
2014-06-04 16:54:14 -07:00
mm: page_alloc: use jump labels to avoid checking number_of_cpusets
2014-06-04 16:54:08 -07:00
kernel/exec_domain.c: code clean-up
2014-06-04 16:54:15 -07:00
signals: mv {dis,}allow_signal() from sched.h/exit.c to signal.[ch]
2014-06-06 16:08:11 -07:00
asmlinkage: Make main_extable_sort_needed visible
2014-02-13 18:13:22 -08:00
ptrace: fix fork event messages across pid namespaces
2014-06-06 16:08:11 -07:00
Merge branch 'locking-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip into next
2014-06-03 12:57:53 -07:00
compat: Get rid of (get|put)_compat_time(val|spec)
2014-02-02 14:09:12 -08:00
kernel/groups.c: remove return value of set_groups
2014-04-03 16:21:05 -07:00
Merge branch 'perf-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip into next
2014-06-03 13:18:00 -07:00
kernel/hung_task.c: convert simple_strtoul to kstrtouint
2014-06-04 16:54:15 -07:00
perf/x86: Warn to early_printk() in case irq_work is too slow
2014-02-21 21:49:07 +01:00
kernel: use macros from compiler.h instead of __attribute__((...))
2014-04-07 16:36:11 -07:00
kernel/kexec.c: convert printk to pr_foo()
2014-06-06 16:08:12 -07:00
signals: change wait_for_helper() to use kernel_sigaction()
2014-06-06 16:08:12 -07:00
kobject: Make support for uevent_helper optional.
2014-04-25 12:00:49 -07:00
kthread: fix return value of kthread_create() upon SIGKILL.
2014-06-04 16:53:51 -07:00
kernel/latencytop.c: convert seq_printf to seq_puts
2014-06-04 16:54:15 -07:00
Merge branch 'x86-asmlinkage-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2014-03-31 14:13:25 -07:00
Fixed one missing place for the new taint flag, and remove a warning
2014-05-01 10:35:01 -07:00
notifier: Substitute rcu_access_pointer() for rcu_dereference_raw()
2014-02-26 06:35:13 -08:00
kernel/panic.c: add "crash_kexec_post_notifiers" option for kdump after panic_notifers
2014-06-06 16:08:12 -07:00
pid_namespace: pidns_get() should check task_active_pid_ns() != NULL
2014-04-02 16:20:21 -07:00
CPU hotplug notifiers registration fixes for 3.15-rc1
2014-04-07 14:55:46 -07:00
kernel/compat: convert to COMPAT_SYSCALL_DEFINE
2014-03-06 15:35:10 +01:00
kernel/reboot.c: convert simple_strtoul to kstrtoint
2014-06-04 16:54:15 -07:00
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2014-04-12 14:49:50 -07:00
kernel/res_counter.c: replace simple_strtoull by kstrtoull
2014-06-04 16:54:15 -07:00
resources: Clarify sanity check message
2014-05-23 10:47:21 -06:00
seccomp: fix memory leak on filter attach
2014-04-16 15:25:53 -04:00
signals: introduce kernel_sigaction()
2014-06-06 16:08:12 -07:00
smp: print more useful debug info upon receiving IPI on an offline CPU
2014-06-06 16:08:12 -07:00
Merge branch 'rcu/next' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu into core/rcu
2014-05-22 11:36:10 +02:00
kernel/stop_machine.c: kernel-doc warning fix
2014-06-04 16:54:15 -07:00
sched: Consolidate open coded implementations of nice level frobbing into nice_to_rlimit() and rlimit_to_nice()
2014-05-22 11:16:36 +02:00
sys_sgetmask/sys_ssetmask: add CONFIG_SGETMASK_SYSCALL
2014-06-04 16:54:14 -07:00
sysctl: allow for strict write position handling
2014-06-06 16:08:13 -07:00
timer: Prevent overflow in apply_slack
2014-04-30 13:46:17 +02:00
torture: Remove __init from torture_init_begin/end
2014-05-14 09:46:30 -07:00
kernel/tracepoint.c: kernel-doc fixes
2014-06-04 16:54:15 -07:00
smp: Rename __smp_call_function_single() to smp_call_function_single_async()
2014-02-24 14:47:15 -08:00
kernel/user.c: drop unused field 'files' from user_struct
2014-06-04 16:54:16 -07:00
user namespace: fix incorrect memory barriers
2014-04-14 16:03:02 -07:00
kernel/utsname_sysctl.c: replace obsolete __initcall by device_initcall
2014-06-04 16:54:15 -07:00
kernel/watchdog.c:touch_softlockup_watchdog(): use raw_cpu_write()
2014-04-18 16:40:08 -07:00
Linux 3.15-rc6
2014-05-22 10:28:56 +02:00
f4aacea2f5