2005-04-16 16:20:36 -06:00
|
|
|
#ifndef _LINUX_BINFMTS_H
|
|
|
|
|
#define _LINUX_BINFMTS_H
|
|
|
|
|
|
2012-02-04 02:47:10 -07:00
|
|
|
#include <linux/sched.h>
|
2012-09-30 11:20:09 -06:00
|
|
|
#include <linux/unistd.h>
|
2012-08-03 02:14:44 -06:00
|
|
|
#include <asm/exec.h>
|
2012-10-13 03:46:48 -06:00
|
|
|
#include <uapi/linux/binfmts.h>
|
2005-04-16 16:20:36 -06:00
|
|
|
|
2007-05-16 23:11:16 -06:00
|
|
|
#define CORENAME_MAX_SIZE 128
|
|
|
|
|
|
2005-04-16 16:20:36 -06:00
|
|
|
/*
|
|
|
|
|
* This structure is used to hold the arguments that are used when loading binaries.
|
|
|
|
|
*/
|
2011-01-12 18:00:02 -07:00
|
|
|
struct linux_binprm {
|
2005-04-16 16:20:36 -06:00
|
|
|
char buf[BINPRM_BUF_SIZE];
|
2007-07-19 02:48:16 -06:00
|
|
|
#ifdef CONFIG_MMU
|
|
|
|
|
struct vm_area_struct *vma;
|
2010-11-30 12:55:34 -07:00
|
|
|
unsigned long vma_pages;
|
2007-07-19 02:48:16 -06:00
|
|
|
#else
|
|
|
|
|
# define MAX_ARG_PAGES 32
|
2005-04-16 16:20:36 -06:00
|
|
|
struct page *page[MAX_ARG_PAGES];
|
2007-07-19 02:48:16 -06:00
|
|
|
#endif
|
2005-04-16 16:20:36 -06:00
|
|
|
struct mm_struct *mm;
|
|
|
|
|
unsigned long p; /* current top of mem */
|
2009-04-02 17:58:29 -06:00
|
|
|
unsigned int
|
CRED: Make execve() take advantage of copy-on-write credentials
Make execve() take advantage of copy-on-write credentials, allowing it to set
up the credentials in advance, and then commit the whole lot after the point
of no return.
This patch and the preceding patches have been tested with the LTP SELinux
testsuite.
This patch makes several logical sets of alteration:
(1) execve().
The credential bits from struct linux_binprm are, for the most part,
replaced with a single credentials pointer (bprm->cred). This means that
all the creds can be calculated in advance and then applied at the point
of no return with no possibility of failure.
I would like to replace bprm->cap_effective with:
cap_isclear(bprm->cap_effective)
but this seems impossible due to special behaviour for processes of pid 1
(they always retain their parent's capability masks where normally they'd
be changed - see cap_bprm_set_creds()).
The following sequence of events now happens:
(a) At the start of do_execve, the current task's cred_exec_mutex is
locked to prevent PTRACE_ATTACH from obsoleting the calculation of
creds that we make.
(a) prepare_exec_creds() is then called to make a copy of the current
task's credentials and prepare it. This copy is then assigned to
bprm->cred.
This renders security_bprm_alloc() and security_bprm_free()
unnecessary, and so they've been removed.
(b) The determination of unsafe execution is now performed immediately
after (a) rather than later on in the code. The result is stored in
bprm->unsafe for future reference.
(c) prepare_binprm() is called, possibly multiple times.
(i) This applies the result of set[ug]id binaries to the new creds
attached to bprm->cred. Personality bit clearance is recorded,
but now deferred on the basis that the exec procedure may yet
fail.
(ii) This then calls the new security_bprm_set_creds(). This should
calculate the new LSM and capability credentials into *bprm->cred.
This folds together security_bprm_set() and parts of
security_bprm_apply_creds() (these two have been removed).
Anything that might fail must be done at this point.
(iii) bprm->cred_prepared is set to 1.
bprm->cred_prepared is 0 on the first pass of the security
calculations, and 1 on all subsequent passes. This allows SELinux
in (ii) to base its calculations only on the initial script and
not on the interpreter.
(d) flush_old_exec() is called to commit the task to execution. This
performs the following steps with regard to credentials:
(i) Clear pdeath_signal and set dumpable on certain circumstances that
may not be covered by commit_creds().
(ii) Clear any bits in current->personality that were deferred from
(c.i).
(e) install_exec_creds() [compute_creds() as was] is called to install the
new credentials. This performs the following steps with regard to
credentials:
(i) Calls security_bprm_committing_creds() to apply any security
requirements, such as flushing unauthorised files in SELinux, that
must be done before the credentials are changed.
This is made up of bits of security_bprm_apply_creds() and
security_bprm_post_apply_creds(), both of which have been removed.
This function is not allowed to fail; anything that might fail
must have been done in (c.ii).
(ii) Calls commit_creds() to apply the new credentials in a single
assignment (more or less). Possibly pdeath_signal and dumpable
should be part of struct creds.
(iii) Unlocks the task's cred_replace_mutex, thus allowing
PTRACE_ATTACH to take place.
(iv) Clears The bprm->cred pointer as the credentials it was holding
are now immutable.
(v) Calls security_bprm_committed_creds() to apply any security
alterations that must be done after the creds have been changed.
SELinux uses this to flush signals and signal handlers.
(f) If an error occurs before (d.i), bprm_free() will call abort_creds()
to destroy the proposed new credentials and will then unlock
cred_replace_mutex. No changes to the credentials will have been
made.
(2) LSM interface.
A number of functions have been changed, added or removed:
(*) security_bprm_alloc(), ->bprm_alloc_security()
(*) security_bprm_free(), ->bprm_free_security()
Removed in favour of preparing new credentials and modifying those.
(*) security_bprm_apply_creds(), ->bprm_apply_creds()
(*) security_bprm_post_apply_creds(), ->bprm_post_apply_creds()
Removed; split between security_bprm_set_creds(),
security_bprm_committing_creds() and security_bprm_committed_creds().
(*) security_bprm_set(), ->bprm_set_security()
Removed; folded into security_bprm_set_creds().
(*) security_bprm_set_creds(), ->bprm_set_creds()
New. The new credentials in bprm->creds should be checked and set up
as appropriate. bprm->cred_prepared is 0 on the first call, 1 on the
second and subsequent calls.
(*) security_bprm_committing_creds(), ->bprm_committing_creds()
(*) security_bprm_committed_creds(), ->bprm_committed_creds()
New. Apply the security effects of the new credentials. This
includes closing unauthorised files in SELinux. This function may not
fail. When the former is called, the creds haven't yet been applied
to the process; when the latter is called, they have.
The former may access bprm->cred, the latter may not.
(3) SELinux.
SELinux has a number of changes, in addition to those to support the LSM
interface changes mentioned above:
(a) The bprm_security_struct struct has been removed in favour of using
the credentials-under-construction approach.
(c) flush_unauthorized_files() now takes a cred pointer and passes it on
to inode_has_perm(), file_has_perm() and dentry_open().
Signed-off-by: David Howells <dhowells@redhat.com>
Acked-by: James Morris <jmorris@namei.org>
Acked-by: Serge Hallyn <serue@us.ibm.com>
Signed-off-by: James Morris <jmorris@namei.org>
2008-11-13 16:39:24 -07:00
|
|
|
cred_prepared:1,/* true if creds already prepared (multiple
|
|
|
|
|
* preps happen for interpreters) */
|
|
|
|
|
cap_effective:1;/* true if has elevated effective capabilities,
|
|
|
|
|
* false if not; except for init which inherits
|
|
|
|
|
* its parent's caps anyway */
|
2008-10-15 23:02:37 -06:00
|
|
|
#ifdef __alpha__
|
|
|
|
|
unsigned int taso:1;
|
|
|
|
|
#endif
|
2008-10-15 23:02:39 -06:00
|
|
|
unsigned int recursion_depth;
|
2005-04-16 16:20:36 -06:00
|
|
|
struct file * file;
|
CRED: Make execve() take advantage of copy-on-write credentials
Make execve() take advantage of copy-on-write credentials, allowing it to set
up the credentials in advance, and then commit the whole lot after the point
of no return.
This patch and the preceding patches have been tested with the LTP SELinux
testsuite.
This patch makes several logical sets of alteration:
(1) execve().
The credential bits from struct linux_binprm are, for the most part,
replaced with a single credentials pointer (bprm->cred). This means that
all the creds can be calculated in advance and then applied at the point
of no return with no possibility of failure.
I would like to replace bprm->cap_effective with:
cap_isclear(bprm->cap_effective)
but this seems impossible due to special behaviour for processes of pid 1
(they always retain their parent's capability masks where normally they'd
be changed - see cap_bprm_set_creds()).
The following sequence of events now happens:
(a) At the start of do_execve, the current task's cred_exec_mutex is
locked to prevent PTRACE_ATTACH from obsoleting the calculation of
creds that we make.
(a) prepare_exec_creds() is then called to make a copy of the current
task's credentials and prepare it. This copy is then assigned to
bprm->cred.
This renders security_bprm_alloc() and security_bprm_free()
unnecessary, and so they've been removed.
(b) The determination of unsafe execution is now performed immediately
after (a) rather than later on in the code. The result is stored in
bprm->unsafe for future reference.
(c) prepare_binprm() is called, possibly multiple times.
(i) This applies the result of set[ug]id binaries to the new creds
attached to bprm->cred. Personality bit clearance is recorded,
but now deferred on the basis that the exec procedure may yet
fail.
(ii) This then calls the new security_bprm_set_creds(). This should
calculate the new LSM and capability credentials into *bprm->cred.
This folds together security_bprm_set() and parts of
security_bprm_apply_creds() (these two have been removed).
Anything that might fail must be done at this point.
(iii) bprm->cred_prepared is set to 1.
bprm->cred_prepared is 0 on the first pass of the security
calculations, and 1 on all subsequent passes. This allows SELinux
in (ii) to base its calculations only on the initial script and
not on the interpreter.
(d) flush_old_exec() is called to commit the task to execution. This
performs the following steps with regard to credentials:
(i) Clear pdeath_signal and set dumpable on certain circumstances that
may not be covered by commit_creds().
(ii) Clear any bits in current->personality that were deferred from
(c.i).
(e) install_exec_creds() [compute_creds() as was] is called to install the
new credentials. This performs the following steps with regard to
credentials:
(i) Calls security_bprm_committing_creds() to apply any security
requirements, such as flushing unauthorised files in SELinux, that
must be done before the credentials are changed.
This is made up of bits of security_bprm_apply_creds() and
security_bprm_post_apply_creds(), both of which have been removed.
This function is not allowed to fail; anything that might fail
must have been done in (c.ii).
(ii) Calls commit_creds() to apply the new credentials in a single
assignment (more or less). Possibly pdeath_signal and dumpable
should be part of struct creds.
(iii) Unlocks the task's cred_replace_mutex, thus allowing
PTRACE_ATTACH to take place.
(iv) Clears The bprm->cred pointer as the credentials it was holding
are now immutable.
(v) Calls security_bprm_committed_creds() to apply any security
alterations that must be done after the creds have been changed.
SELinux uses this to flush signals and signal handlers.
(f) If an error occurs before (d.i), bprm_free() will call abort_creds()
to destroy the proposed new credentials and will then unlock
cred_replace_mutex. No changes to the credentials will have been
made.
(2) LSM interface.
A number of functions have been changed, added or removed:
(*) security_bprm_alloc(), ->bprm_alloc_security()
(*) security_bprm_free(), ->bprm_free_security()
Removed in favour of preparing new credentials and modifying those.
(*) security_bprm_apply_creds(), ->bprm_apply_creds()
(*) security_bprm_post_apply_creds(), ->bprm_post_apply_creds()
Removed; split between security_bprm_set_creds(),
security_bprm_committing_creds() and security_bprm_committed_creds().
(*) security_bprm_set(), ->bprm_set_security()
Removed; folded into security_bprm_set_creds().
(*) security_bprm_set_creds(), ->bprm_set_creds()
New. The new credentials in bprm->creds should be checked and set up
as appropriate. bprm->cred_prepared is 0 on the first call, 1 on the
second and subsequent calls.
(*) security_bprm_committing_creds(), ->bprm_committing_creds()
(*) security_bprm_committed_creds(), ->bprm_committed_creds()
New. Apply the security effects of the new credentials. This
includes closing unauthorised files in SELinux. This function may not
fail. When the former is called, the creds haven't yet been applied
to the process; when the latter is called, they have.
The former may access bprm->cred, the latter may not.
(3) SELinux.
SELinux has a number of changes, in addition to those to support the LSM
interface changes mentioned above:
(a) The bprm_security_struct struct has been removed in favour of using
the credentials-under-construction approach.
(c) flush_unauthorized_files() now takes a cred pointer and passes it on
to inode_has_perm(), file_has_perm() and dentry_open().
Signed-off-by: David Howells <dhowells@redhat.com>
Acked-by: James Morris <jmorris@namei.org>
Acked-by: Serge Hallyn <serue@us.ibm.com>
Signed-off-by: James Morris <jmorris@namei.org>
2008-11-13 16:39:24 -07:00
|
|
|
struct cred *cred; /* new credentials */
|
|
|
|
|
int unsafe; /* how unsafe this exec is (mask of LSM_UNSAFE_*) */
|
|
|
|
|
unsigned int per_clear; /* bits to clear in current->personality */
|
2005-04-16 16:20:36 -06:00
|
|
|
int argc, envc;
|
2010-08-17 16:52:56 -06:00
|
|
|
const char * filename; /* Name of binary as seen by procps */
|
|
|
|
|
const char * interp; /* Name of the binary really executed. Most
|
2005-04-16 16:20:36 -06:00
|
|
|
of the time same as filename, but could be
|
|
|
|
|
different for binfmt_{misc,script} */
|
|
|
|
|
unsigned interp_flags;
|
|
|
|
|
unsigned interp_data;
|
|
|
|
|
unsigned long loader, exec;
|
2012-02-04 02:47:10 -07:00
|
|
|
char tcomm[TASK_COMM_LEN];
|
2005-04-16 16:20:36 -06:00
|
|
|
};
|
|
|
|
|
|
|
|
|
|
#define BINPRM_FLAGS_ENFORCE_NONDUMP_BIT 0
|
|
|
|
|
#define BINPRM_FLAGS_ENFORCE_NONDUMP (1 << BINPRM_FLAGS_ENFORCE_NONDUMP_BIT)
|
|
|
|
|
|
|
|
|
|
/* fd of the binary should be passed to the interpreter */
|
|
|
|
|
#define BINPRM_FLAGS_EXECFD_BIT 1
|
|
|
|
|
#define BINPRM_FLAGS_EXECFD (1 << BINPRM_FLAGS_EXECFD_BIT)
|
|
|
|
|
|
2009-12-17 16:27:16 -07:00
|
|
|
/* Function parameter for binfmt->coredump */
|
|
|
|
|
struct coredump_params {
|
2012-10-04 18:15:29 -06:00
|
|
|
siginfo_t *siginfo;
|
2009-12-17 16:27:16 -07:00
|
|
|
struct pt_regs *regs;
|
|
|
|
|
struct file *file;
|
|
|
|
|
unsigned long limit;
|
2010-03-05 14:44:12 -07:00
|
|
|
unsigned long mm_flags;
|
2009-12-17 16:27:16 -07:00
|
|
|
};
|
|
|
|
|
|
2005-04-16 16:20:36 -06:00
|
|
|
/*
|
|
|
|
|
* This structure defines the functions that are used to load the binary formats that
|
|
|
|
|
* linux accepts.
|
|
|
|
|
*/
|
|
|
|
|
struct linux_binfmt {
|
2007-10-17 00:26:03 -06:00
|
|
|
struct list_head lh;
|
2005-04-16 16:20:36 -06:00
|
|
|
struct module *module;
|
2012-10-20 20:00:48 -06:00
|
|
|
int (*load_binary)(struct linux_binprm *);
|
2005-04-16 16:20:36 -06:00
|
|
|
int (*load_shlib)(struct file *);
|
2009-12-17 16:27:16 -07:00
|
|
|
int (*core_dump)(struct coredump_params *cprm);
|
2005-04-16 16:20:36 -06:00
|
|
|
unsigned long min_coredump; /* minimal dump size */
|
|
|
|
|
};
|
|
|
|
|
|
2012-03-17 01:05:16 -06:00
|
|
|
extern void __register_binfmt(struct linux_binfmt *fmt, int insert);
|
2009-04-30 16:08:49 -06:00
|
|
|
|
|
|
|
|
/* Registration of default binfmt handlers */
|
2012-03-17 01:05:16 -06:00
|
|
|
static inline void register_binfmt(struct linux_binfmt *fmt)
|
2009-04-30 16:08:49 -06:00
|
|
|
{
|
2012-03-17 01:05:16 -06:00
|
|
|
__register_binfmt(fmt, 0);
|
2009-04-30 16:08:49 -06:00
|
|
|
}
|
|
|
|
|
/* Same as above, but adds a new binfmt at the top of the list */
|
2012-03-17 01:05:16 -06:00
|
|
|
static inline void insert_binfmt(struct linux_binfmt *fmt)
|
2009-04-30 16:08:49 -06:00
|
|
|
{
|
2012-03-17 01:05:16 -06:00
|
|
|
__register_binfmt(fmt, 1);
|
2009-04-30 16:08:49 -06:00
|
|
|
}
|
|
|
|
|
|
2007-10-17 00:26:04 -06:00
|
|
|
extern void unregister_binfmt(struct linux_binfmt *);
|
2005-04-16 16:20:36 -06:00
|
|
|
|
|
|
|
|
extern int prepare_binprm(struct linux_binprm *);
|
2007-07-19 02:48:16 -06:00
|
|
|
extern int __must_check remove_arg_zero(struct linux_binprm *);
|
2012-10-20 19:53:31 -06:00
|
|
|
extern int search_binary_handler(struct linux_binprm *);
|
2005-04-16 16:20:36 -06:00
|
|
|
extern int flush_old_exec(struct linux_binprm * bprm);
|
Split 'flush_old_exec' into two functions
'flush_old_exec()' is the point of no return when doing an execve(), and
it is pretty badly misnamed. It doesn't just flush the old executable
environment, it also starts up the new one.
Which is very inconvenient for things like setting up the new
personality, because we want the new personality to affect the starting
of the new environment, but at the same time we do _not_ want the new
personality to take effect if flushing the old one fails.
As a result, the x86-64 '32-bit' personality is actually done using this
insane "I'm going to change the ABI, but I haven't done it yet" bit
(TIF_ABI_PENDING), with SET_PERSONALITY() not actually setting the
personality, but just the "pending" bit, so that "flush_thread()" can do
the actual personality magic.
This patch in no way changes any of that insanity, but it does split the
'flush_old_exec()' function up into a preparatory part that can fail
(still called flush_old_exec()), and a new part that will actually set
up the new exec environment (setup_new_exec()). All callers are changed
to trivially comply with the new world order.
Signed-off-by: H. Peter Anvin <hpa@zytor.com>
Cc: stable@kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2010-01-28 23:14:42 -07:00
|
|
|
extern void setup_new_exec(struct linux_binprm * bprm);
|
2011-06-19 10:49:47 -06:00
|
|
|
extern void would_dump(struct linux_binprm *, struct file *);
|
2005-04-16 16:20:36 -06:00
|
|
|
|
2005-06-23 01:09:43 -06:00
|
|
|
extern int suid_dumpable;
|
|
|
|
|
#define SUID_DUMP_DISABLE 0 /* No setuid dumping */
|
|
|
|
|
#define SUID_DUMP_USER 1 /* Dump as user of process */
|
|
|
|
|
#define SUID_DUMP_ROOT 2 /* Dump as root */
|
|
|
|
|
|
2005-04-16 16:20:36 -06:00
|
|
|
/* Stack area protections */
|
|
|
|
|
#define EXSTACK_DEFAULT 0 /* Whatever the arch defaults to */
|
|
|
|
|
#define EXSTACK_DISABLE_X 1 /* Disable executable stacks */
|
|
|
|
|
#define EXSTACK_ENABLE_X 2 /* Enable executable stacks */
|
|
|
|
|
|
|
|
|
|
extern int setup_arg_pages(struct linux_binprm * bprm,
|
|
|
|
|
unsigned long stack_top,
|
|
|
|
|
int executable_stack);
|
2007-07-19 02:48:16 -06:00
|
|
|
extern int bprm_mm_init(struct linux_binprm *bprm);
|
exec: do not leave bprm->interp on stack
If a series of scripts are executed, each triggering module loading via
unprintable bytes in the script header, kernel stack contents can leak
into the command line.
Normally execution of binfmt_script and binfmt_misc happens recursively.
However, when modules are enabled, and unprintable bytes exist in the
bprm->buf, execution will restart after attempting to load matching
binfmt modules. Unfortunately, the logic in binfmt_script and
binfmt_misc does not expect to get restarted. They leave bprm->interp
pointing to their local stack. This means on restart bprm->interp is
left pointing into unused stack memory which can then be copied into the
userspace argv areas.
After additional study, it seems that both recursion and restart remains
the desirable way to handle exec with scripts, misc, and modules. As
such, we need to protect the changes to interp.
This changes the logic to require allocation for any changes to the
bprm->interp. To avoid adding a new kmalloc to every exec, the default
value is left as-is. Only when passing through binfmt_script or
binfmt_misc does an allocation take place.
For a proof of concept, see DoTest.sh from:
http://www.halfdog.net/Security/2012/LinuxKernelBinfmtScriptStackDataDisclosure/
Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: halfdog <me@halfdog.net>
Cc: P J P <ppandit@redhat.com>
Cc: Alexander Viro <viro@zeniv.linux.org.uk>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2012-12-20 16:05:16 -07:00
|
|
|
extern int bprm_change_interp(char *interp, struct linux_binprm *bprm);
|
2010-08-17 16:52:56 -06:00
|
|
|
extern int copy_strings_kernel(int argc, const char *const *argv,
|
|
|
|
|
struct linux_binprm *bprm);
|
2009-09-05 12:17:13 -06:00
|
|
|
extern int prepare_bprm_creds(struct linux_binprm *bprm);
|
CRED: Make execve() take advantage of copy-on-write credentials
Make execve() take advantage of copy-on-write credentials, allowing it to set
up the credentials in advance, and then commit the whole lot after the point
of no return.
This patch and the preceding patches have been tested with the LTP SELinux
testsuite.
This patch makes several logical sets of alteration:
(1) execve().
The credential bits from struct linux_binprm are, for the most part,
replaced with a single credentials pointer (bprm->cred). This means that
all the creds can be calculated in advance and then applied at the point
of no return with no possibility of failure.
I would like to replace bprm->cap_effective with:
cap_isclear(bprm->cap_effective)
but this seems impossible due to special behaviour for processes of pid 1
(they always retain their parent's capability masks where normally they'd
be changed - see cap_bprm_set_creds()).
The following sequence of events now happens:
(a) At the start of do_execve, the current task's cred_exec_mutex is
locked to prevent PTRACE_ATTACH from obsoleting the calculation of
creds that we make.
(a) prepare_exec_creds() is then called to make a copy of the current
task's credentials and prepare it. This copy is then assigned to
bprm->cred.
This renders security_bprm_alloc() and security_bprm_free()
unnecessary, and so they've been removed.
(b) The determination of unsafe execution is now performed immediately
after (a) rather than later on in the code. The result is stored in
bprm->unsafe for future reference.
(c) prepare_binprm() is called, possibly multiple times.
(i) This applies the result of set[ug]id binaries to the new creds
attached to bprm->cred. Personality bit clearance is recorded,
but now deferred on the basis that the exec procedure may yet
fail.
(ii) This then calls the new security_bprm_set_creds(). This should
calculate the new LSM and capability credentials into *bprm->cred.
This folds together security_bprm_set() and parts of
security_bprm_apply_creds() (these two have been removed).
Anything that might fail must be done at this point.
(iii) bprm->cred_prepared is set to 1.
bprm->cred_prepared is 0 on the first pass of the security
calculations, and 1 on all subsequent passes. This allows SELinux
in (ii) to base its calculations only on the initial script and
not on the interpreter.
(d) flush_old_exec() is called to commit the task to execution. This
performs the following steps with regard to credentials:
(i) Clear pdeath_signal and set dumpable on certain circumstances that
may not be covered by commit_creds().
(ii) Clear any bits in current->personality that were deferred from
(c.i).
(e) install_exec_creds() [compute_creds() as was] is called to install the
new credentials. This performs the following steps with regard to
credentials:
(i) Calls security_bprm_committing_creds() to apply any security
requirements, such as flushing unauthorised files in SELinux, that
must be done before the credentials are changed.
This is made up of bits of security_bprm_apply_creds() and
security_bprm_post_apply_creds(), both of which have been removed.
This function is not allowed to fail; anything that might fail
must have been done in (c.ii).
(ii) Calls commit_creds() to apply the new credentials in a single
assignment (more or less). Possibly pdeath_signal and dumpable
should be part of struct creds.
(iii) Unlocks the task's cred_replace_mutex, thus allowing
PTRACE_ATTACH to take place.
(iv) Clears The bprm->cred pointer as the credentials it was holding
are now immutable.
(v) Calls security_bprm_committed_creds() to apply any security
alterations that must be done after the creds have been changed.
SELinux uses this to flush signals and signal handlers.
(f) If an error occurs before (d.i), bprm_free() will call abort_creds()
to destroy the proposed new credentials and will then unlock
cred_replace_mutex. No changes to the credentials will have been
made.
(2) LSM interface.
A number of functions have been changed, added or removed:
(*) security_bprm_alloc(), ->bprm_alloc_security()
(*) security_bprm_free(), ->bprm_free_security()
Removed in favour of preparing new credentials and modifying those.
(*) security_bprm_apply_creds(), ->bprm_apply_creds()
(*) security_bprm_post_apply_creds(), ->bprm_post_apply_creds()
Removed; split between security_bprm_set_creds(),
security_bprm_committing_creds() and security_bprm_committed_creds().
(*) security_bprm_set(), ->bprm_set_security()
Removed; folded into security_bprm_set_creds().
(*) security_bprm_set_creds(), ->bprm_set_creds()
New. The new credentials in bprm->creds should be checked and set up
as appropriate. bprm->cred_prepared is 0 on the first call, 1 on the
second and subsequent calls.
(*) security_bprm_committing_creds(), ->bprm_committing_creds()
(*) security_bprm_committed_creds(), ->bprm_committed_creds()
New. Apply the security effects of the new credentials. This
includes closing unauthorised files in SELinux. This function may not
fail. When the former is called, the creds haven't yet been applied
to the process; when the latter is called, they have.
The former may access bprm->cred, the latter may not.
(3) SELinux.
SELinux has a number of changes, in addition to those to support the LSM
interface changes mentioned above:
(a) The bprm_security_struct struct has been removed in favour of using
the credentials-under-construction approach.
(c) flush_unauthorized_files() now takes a cred pointer and passes it on
to inode_has_perm(), file_has_perm() and dentry_open().
Signed-off-by: David Howells <dhowells@redhat.com>
Acked-by: James Morris <jmorris@namei.org>
Acked-by: Serge Hallyn <serue@us.ibm.com>
Signed-off-by: James Morris <jmorris@namei.org>
2008-11-13 16:39:24 -07:00
|
|
|
extern void install_exec_creds(struct linux_binprm *bprm);
|
2009-09-23 16:56:59 -06:00
|
|
|
extern void set_binfmt(struct linux_binfmt *new);
|
2008-05-10 14:38:25 -06:00
|
|
|
extern void free_bprm(struct linux_binprm *);
|
2005-04-16 16:20:36 -06:00
|
|
|
|
|
|
|
|
#endif /* _LINUX_BINFMTS_H */
|
