2005-04-17 02:20:36 +04:00
|
|
|
#ifndef _LINUX_BINFMTS_H
|
|
|
|
|
#define _LINUX_BINFMTS_H
|
|
|
|
|
|
|
|
|
|
#include <linux/capability.h>
|
|
|
|
|
|
|
|
|
|
struct pt_regs;
|
|
|
|
|
|
|
|
|
|
/*
|
2007-07-19 12:48:16 +04:00
|
|
|
* These are the maximum length and maximum number of strings passed to the
|
|
|
|
|
* execve() system call. MAX_ARG_STRLEN is essentially random but serves to
|
|
|
|
|
* prevent the kernel from being unduly impacted by misaddressed pointers.
|
|
|
|
|
* MAX_ARG_STRINGS is chosen to fit in a signed 32-bit integer.
|
2005-04-17 02:20:36 +04:00
|
|
|
*/
|
2007-07-19 12:48:16 +04:00
|
|
|
#define MAX_ARG_STRLEN (PAGE_SIZE * 32)
|
|
|
|
|
#define MAX_ARG_STRINGS 0x7FFFFFFF
|
2005-04-17 02:20:36 +04:00
|
|
|
|
|
|
|
|
/* sizeof(linux_binprm->buf) */
|
|
|
|
|
#define BINPRM_BUF_SIZE 128
|
|
|
|
|
|
|
|
|
|
#ifdef __KERNEL__
|
2009-01-07 01:41:38 +03:00
|
|
|
#include <linux/list.h>
|
2005-04-17 02:20:36 +04:00
|
|
|
|
2007-05-17 09:11:16 +04:00
|
|
|
#define CORENAME_MAX_SIZE 128
|
|
|
|
|
|
2005-04-17 02:20:36 +04:00
|
|
|
/*
|
|
|
|
|
* This structure is used to hold the arguments that are used when loading binaries.
|
|
|
|
|
*/
|
|
|
|
|
struct linux_binprm{
|
|
|
|
|
char buf[BINPRM_BUF_SIZE];
|
2007-07-19 12:48:16 +04:00
|
|
|
#ifdef CONFIG_MMU
|
|
|
|
|
struct vm_area_struct *vma;
|
|
|
|
|
#else
|
|
|
|
|
# define MAX_ARG_PAGES 32
|
2005-04-17 02:20:36 +04:00
|
|
|
struct page *page[MAX_ARG_PAGES];
|
2007-07-19 12:48:16 +04:00
|
|
|
#endif
|
2005-04-17 02:20:36 +04:00
|
|
|
struct mm_struct *mm;
|
|
|
|
|
unsigned long p; /* current top of mem */
|
2009-04-03 03:58:29 +04:00
|
|
|
unsigned int
|
CRED: Make execve() take advantage of copy-on-write credentials
Make execve() take advantage of copy-on-write credentials, allowing it to set
up the credentials in advance, and then commit the whole lot after the point
of no return.
This patch and the preceding patches have been tested with the LTP SELinux
testsuite.
This patch makes several logical sets of alteration:
(1) execve().
The credential bits from struct linux_binprm are, for the most part,
replaced with a single credentials pointer (bprm->cred). This means that
all the creds can be calculated in advance and then applied at the point
of no return with no possibility of failure.
I would like to replace bprm->cap_effective with:
cap_isclear(bprm->cap_effective)
but this seems impossible due to special behaviour for processes of pid 1
(they always retain their parent's capability masks where normally they'd
be changed - see cap_bprm_set_creds()).
The following sequence of events now happens:
(a) At the start of do_execve, the current task's cred_exec_mutex is
locked to prevent PTRACE_ATTACH from obsoleting the calculation of
creds that we make.
(a) prepare_exec_creds() is then called to make a copy of the current
task's credentials and prepare it. This copy is then assigned to
bprm->cred.
This renders security_bprm_alloc() and security_bprm_free()
unnecessary, and so they've been removed.
(b) The determination of unsafe execution is now performed immediately
after (a) rather than later on in the code. The result is stored in
bprm->unsafe for future reference.
(c) prepare_binprm() is called, possibly multiple times.
(i) This applies the result of set[ug]id binaries to the new creds
attached to bprm->cred. Personality bit clearance is recorded,
but now deferred on the basis that the exec procedure may yet
fail.
(ii) This then calls the new security_bprm_set_creds(). This should
calculate the new LSM and capability credentials into *bprm->cred.
This folds together security_bprm_set() and parts of
security_bprm_apply_creds() (these two have been removed).
Anything that might fail must be done at this point.
(iii) bprm->cred_prepared is set to 1.
bprm->cred_prepared is 0 on the first pass of the security
calculations, and 1 on all subsequent passes. This allows SELinux
in (ii) to base its calculations only on the initial script and
not on the interpreter.
(d) flush_old_exec() is called to commit the task to execution. This
performs the following steps with regard to credentials:
(i) Clear pdeath_signal and set dumpable on certain circumstances that
may not be covered by commit_creds().
(ii) Clear any bits in current->personality that were deferred from
(c.i).
(e) install_exec_creds() [compute_creds() as was] is called to install the
new credentials. This performs the following steps with regard to
credentials:
(i) Calls security_bprm_committing_creds() to apply any security
requirements, such as flushing unauthorised files in SELinux, that
must be done before the credentials are changed.
This is made up of bits of security_bprm_apply_creds() and
security_bprm_post_apply_creds(), both of which have been removed.
This function is not allowed to fail; anything that might fail
must have been done in (c.ii).
(ii) Calls commit_creds() to apply the new credentials in a single
assignment (more or less). Possibly pdeath_signal and dumpable
should be part of struct creds.
(iii) Unlocks the task's cred_replace_mutex, thus allowing
PTRACE_ATTACH to take place.
(iv) Clears The bprm->cred pointer as the credentials it was holding
are now immutable.
(v) Calls security_bprm_committed_creds() to apply any security
alterations that must be done after the creds have been changed.
SELinux uses this to flush signals and signal handlers.
(f) If an error occurs before (d.i), bprm_free() will call abort_creds()
to destroy the proposed new credentials and will then unlock
cred_replace_mutex. No changes to the credentials will have been
made.
(2) LSM interface.
A number of functions have been changed, added or removed:
(*) security_bprm_alloc(), ->bprm_alloc_security()
(*) security_bprm_free(), ->bprm_free_security()
Removed in favour of preparing new credentials and modifying those.
(*) security_bprm_apply_creds(), ->bprm_apply_creds()
(*) security_bprm_post_apply_creds(), ->bprm_post_apply_creds()
Removed; split between security_bprm_set_creds(),
security_bprm_committing_creds() and security_bprm_committed_creds().
(*) security_bprm_set(), ->bprm_set_security()
Removed; folded into security_bprm_set_creds().
(*) security_bprm_set_creds(), ->bprm_set_creds()
New. The new credentials in bprm->creds should be checked and set up
as appropriate. bprm->cred_prepared is 0 on the first call, 1 on the
second and subsequent calls.
(*) security_bprm_committing_creds(), ->bprm_committing_creds()
(*) security_bprm_committed_creds(), ->bprm_committed_creds()
New. Apply the security effects of the new credentials. This
includes closing unauthorised files in SELinux. This function may not
fail. When the former is called, the creds haven't yet been applied
to the process; when the latter is called, they have.
The former may access bprm->cred, the latter may not.
(3) SELinux.
SELinux has a number of changes, in addition to those to support the LSM
interface changes mentioned above:
(a) The bprm_security_struct struct has been removed in favour of using
the credentials-under-construction approach.
(c) flush_unauthorized_files() now takes a cred pointer and passes it on
to inode_has_perm(), file_has_perm() and dentry_open().
Signed-off-by: David Howells <dhowells@redhat.com>
Acked-by: James Morris <jmorris@namei.org>
Acked-by: Serge Hallyn <serue@us.ibm.com>
Signed-off-by: James Morris <jmorris@namei.org>
2008-11-14 02:39:24 +03:00
|
|
|
cred_prepared:1,/* true if creds already prepared (multiple
|
|
|
|
|
* preps happen for interpreters) */
|
|
|
|
|
cap_effective:1;/* true if has elevated effective capabilities,
|
|
|
|
|
* false if not; except for init which inherits
|
|
|
|
|
* its parent's caps anyway */
|
2008-10-16 09:02:37 +04:00
|
|
|
#ifdef __alpha__
|
|
|
|
|
unsigned int taso:1;
|
|
|
|
|
#endif
|
2008-10-16 09:02:39 +04:00
|
|
|
unsigned int recursion_depth;
|
2005-04-17 02:20:36 +04:00
|
|
|
struct file * file;
|
CRED: Make execve() take advantage of copy-on-write credentials
Make execve() take advantage of copy-on-write credentials, allowing it to set
up the credentials in advance, and then commit the whole lot after the point
of no return.
This patch and the preceding patches have been tested with the LTP SELinux
testsuite.
This patch makes several logical sets of alteration:
(1) execve().
The credential bits from struct linux_binprm are, for the most part,
replaced with a single credentials pointer (bprm->cred). This means that
all the creds can be calculated in advance and then applied at the point
of no return with no possibility of failure.
I would like to replace bprm->cap_effective with:
cap_isclear(bprm->cap_effective)
but this seems impossible due to special behaviour for processes of pid 1
(they always retain their parent's capability masks where normally they'd
be changed - see cap_bprm_set_creds()).
The following sequence of events now happens:
(a) At the start of do_execve, the current task's cred_exec_mutex is
locked to prevent PTRACE_ATTACH from obsoleting the calculation of
creds that we make.
(a) prepare_exec_creds() is then called to make a copy of the current
task's credentials and prepare it. This copy is then assigned to
bprm->cred.
This renders security_bprm_alloc() and security_bprm_free()
unnecessary, and so they've been removed.
(b) The determination of unsafe execution is now performed immediately
after (a) rather than later on in the code. The result is stored in
bprm->unsafe for future reference.
(c) prepare_binprm() is called, possibly multiple times.
(i) This applies the result of set[ug]id binaries to the new creds
attached to bprm->cred. Personality bit clearance is recorded,
but now deferred on the basis that the exec procedure may yet
fail.
(ii) This then calls the new security_bprm_set_creds(). This should
calculate the new LSM and capability credentials into *bprm->cred.
This folds together security_bprm_set() and parts of
security_bprm_apply_creds() (these two have been removed).
Anything that might fail must be done at this point.
(iii) bprm->cred_prepared is set to 1.
bprm->cred_prepared is 0 on the first pass of the security
calculations, and 1 on all subsequent passes. This allows SELinux
in (ii) to base its calculations only on the initial script and
not on the interpreter.
(d) flush_old_exec() is called to commit the task to execution. This
performs the following steps with regard to credentials:
(i) Clear pdeath_signal and set dumpable on certain circumstances that
may not be covered by commit_creds().
(ii) Clear any bits in current->personality that were deferred from
(c.i).
(e) install_exec_creds() [compute_creds() as was] is called to install the
new credentials. This performs the following steps with regard to
credentials:
(i) Calls security_bprm_committing_creds() to apply any security
requirements, such as flushing unauthorised files in SELinux, that
must be done before the credentials are changed.
This is made up of bits of security_bprm_apply_creds() and
security_bprm_post_apply_creds(), both of which have been removed.
This function is not allowed to fail; anything that might fail
must have been done in (c.ii).
(ii) Calls commit_creds() to apply the new credentials in a single
assignment (more or less). Possibly pdeath_signal and dumpable
should be part of struct creds.
(iii) Unlocks the task's cred_replace_mutex, thus allowing
PTRACE_ATTACH to take place.
(iv) Clears The bprm->cred pointer as the credentials it was holding
are now immutable.
(v) Calls security_bprm_committed_creds() to apply any security
alterations that must be done after the creds have been changed.
SELinux uses this to flush signals and signal handlers.
(f) If an error occurs before (d.i), bprm_free() will call abort_creds()
to destroy the proposed new credentials and will then unlock
cred_replace_mutex. No changes to the credentials will have been
made.
(2) LSM interface.
A number of functions have been changed, added or removed:
(*) security_bprm_alloc(), ->bprm_alloc_security()
(*) security_bprm_free(), ->bprm_free_security()
Removed in favour of preparing new credentials and modifying those.
(*) security_bprm_apply_creds(), ->bprm_apply_creds()
(*) security_bprm_post_apply_creds(), ->bprm_post_apply_creds()
Removed; split between security_bprm_set_creds(),
security_bprm_committing_creds() and security_bprm_committed_creds().
(*) security_bprm_set(), ->bprm_set_security()
Removed; folded into security_bprm_set_creds().
(*) security_bprm_set_creds(), ->bprm_set_creds()
New. The new credentials in bprm->creds should be checked and set up
as appropriate. bprm->cred_prepared is 0 on the first call, 1 on the
second and subsequent calls.
(*) security_bprm_committing_creds(), ->bprm_committing_creds()
(*) security_bprm_committed_creds(), ->bprm_committed_creds()
New. Apply the security effects of the new credentials. This
includes closing unauthorised files in SELinux. This function may not
fail. When the former is called, the creds haven't yet been applied
to the process; when the latter is called, they have.
The former may access bprm->cred, the latter may not.
(3) SELinux.
SELinux has a number of changes, in addition to those to support the LSM
interface changes mentioned above:
(a) The bprm_security_struct struct has been removed in favour of using
the credentials-under-construction approach.
(c) flush_unauthorized_files() now takes a cred pointer and passes it on
to inode_has_perm(), file_has_perm() and dentry_open().
Signed-off-by: David Howells <dhowells@redhat.com>
Acked-by: James Morris <jmorris@namei.org>
Acked-by: Serge Hallyn <serue@us.ibm.com>
Signed-off-by: James Morris <jmorris@namei.org>
2008-11-14 02:39:24 +03:00
|
|
|
struct cred *cred; /* new credentials */
|
|
|
|
|
int unsafe; /* how unsafe this exec is (mask of LSM_UNSAFE_*) */
|
|
|
|
|
unsigned int per_clear; /* bits to clear in current->personality */
|
2005-04-17 02:20:36 +04:00
|
|
|
int argc, envc;
|
|
|
|
|
char * filename; /* Name of binary as seen by procps */
|
|
|
|
|
char * interp; /* Name of the binary really executed. Most
|
|
|
|
|
of the time same as filename, but could be
|
|
|
|
|
different for binfmt_{misc,script} */
|
|
|
|
|
unsigned interp_flags;
|
|
|
|
|
unsigned interp_data;
|
|
|
|
|
unsigned long loader, exec;
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
#define BINPRM_FLAGS_ENFORCE_NONDUMP_BIT 0
|
|
|
|
|
#define BINPRM_FLAGS_ENFORCE_NONDUMP (1 << BINPRM_FLAGS_ENFORCE_NONDUMP_BIT)
|
|
|
|
|
|
|
|
|
|
/* fd of the binary should be passed to the interpreter */
|
|
|
|
|
#define BINPRM_FLAGS_EXECFD_BIT 1
|
|
|
|
|
#define BINPRM_FLAGS_EXECFD (1 << BINPRM_FLAGS_EXECFD_BIT)
|
|
|
|
|
|
2008-10-16 09:02:39 +04:00
|
|
|
#define BINPRM_MAX_RECURSION 4
|
2005-04-17 02:20:36 +04:00
|
|
|
|
|
|
|
|
/*
|
|
|
|
|
* This structure defines the functions that are used to load the binary formats that
|
|
|
|
|
* linux accepts.
|
|
|
|
|
*/
|
|
|
|
|
struct linux_binfmt {
|
2007-10-17 10:26:03 +04:00
|
|
|
struct list_head lh;
|
2005-04-17 02:20:36 +04:00
|
|
|
struct module *module;
|
|
|
|
|
int (*load_binary)(struct linux_binprm *, struct pt_regs * regs);
|
|
|
|
|
int (*load_shlib)(struct file *);
|
2007-10-17 10:26:34 +04:00
|
|
|
int (*core_dump)(long signr, struct pt_regs *regs, struct file *file, unsigned long limit);
|
2005-04-17 02:20:36 +04:00
|
|
|
unsigned long min_coredump; /* minimal dump size */
|
2007-02-13 15:26:26 +03:00
|
|
|
int hasvdso;
|
2005-04-17 02:20:36 +04:00
|
|
|
};
|
|
|
|
|
|
2009-05-01 02:08:49 +04:00
|
|
|
extern int __register_binfmt(struct linux_binfmt *fmt, int insert);
|
|
|
|
|
|
|
|
|
|
/* Registration of default binfmt handlers */
|
|
|
|
|
static inline int register_binfmt(struct linux_binfmt *fmt)
|
|
|
|
|
{
|
|
|
|
|
return __register_binfmt(fmt, 0);
|
|
|
|
|
}
|
|
|
|
|
/* Same as above, but adds a new binfmt at the top of the list */
|
|
|
|
|
static inline int insert_binfmt(struct linux_binfmt *fmt)
|
|
|
|
|
{
|
|
|
|
|
return __register_binfmt(fmt, 1);
|
|
|
|
|
}
|
|
|
|
|
|
2007-10-17 10:26:04 +04:00
|
|
|
extern void unregister_binfmt(struct linux_binfmt *);
|
2005-04-17 02:20:36 +04:00
|
|
|
|
|
|
|
|
extern int prepare_binprm(struct linux_binprm *);
|
2007-07-19 12:48:16 +04:00
|
|
|
extern int __must_check remove_arg_zero(struct linux_binprm *);
|
2005-04-17 02:20:36 +04:00
|
|
|
extern int search_binary_handler(struct linux_binprm *,struct pt_regs *);
|
|
|
|
|
extern int flush_old_exec(struct linux_binprm * bprm);
|
|
|
|
|
|
2005-06-23 11:09:43 +04:00
|
|
|
extern int suid_dumpable;
|
|
|
|
|
#define SUID_DUMP_DISABLE 0 /* No setuid dumping */
|
|
|
|
|
#define SUID_DUMP_USER 1 /* Dump as user of process */
|
|
|
|
|
#define SUID_DUMP_ROOT 2 /* Dump as root */
|
|
|
|
|
|
2005-04-17 02:20:36 +04:00
|
|
|
/* Stack area protections */
|
|
|
|
|
#define EXSTACK_DEFAULT 0 /* Whatever the arch defaults to */
|
|
|
|
|
#define EXSTACK_DISABLE_X 1 /* Disable executable stacks */
|
|
|
|
|
#define EXSTACK_ENABLE_X 2 /* Enable executable stacks */
|
|
|
|
|
|
|
|
|
|
extern int setup_arg_pages(struct linux_binprm * bprm,
|
|
|
|
|
unsigned long stack_top,
|
|
|
|
|
int executable_stack);
|
2007-07-19 12:48:16 +04:00
|
|
|
extern int bprm_mm_init(struct linux_binprm *bprm);
|
2005-04-17 02:20:36 +04:00
|
|
|
extern int copy_strings_kernel(int argc,char ** argv,struct linux_binprm *bprm);
|
CRED: Make execve() take advantage of copy-on-write credentials
Make execve() take advantage of copy-on-write credentials, allowing it to set
up the credentials in advance, and then commit the whole lot after the point
of no return.
This patch and the preceding patches have been tested with the LTP SELinux
testsuite.
This patch makes several logical sets of alteration:
(1) execve().
The credential bits from struct linux_binprm are, for the most part,
replaced with a single credentials pointer (bprm->cred). This means that
all the creds can be calculated in advance and then applied at the point
of no return with no possibility of failure.
I would like to replace bprm->cap_effective with:
cap_isclear(bprm->cap_effective)
but this seems impossible due to special behaviour for processes of pid 1
(they always retain their parent's capability masks where normally they'd
be changed - see cap_bprm_set_creds()).
The following sequence of events now happens:
(a) At the start of do_execve, the current task's cred_exec_mutex is
locked to prevent PTRACE_ATTACH from obsoleting the calculation of
creds that we make.
(a) prepare_exec_creds() is then called to make a copy of the current
task's credentials and prepare it. This copy is then assigned to
bprm->cred.
This renders security_bprm_alloc() and security_bprm_free()
unnecessary, and so they've been removed.
(b) The determination of unsafe execution is now performed immediately
after (a) rather than later on in the code. The result is stored in
bprm->unsafe for future reference.
(c) prepare_binprm() is called, possibly multiple times.
(i) This applies the result of set[ug]id binaries to the new creds
attached to bprm->cred. Personality bit clearance is recorded,
but now deferred on the basis that the exec procedure may yet
fail.
(ii) This then calls the new security_bprm_set_creds(). This should
calculate the new LSM and capability credentials into *bprm->cred.
This folds together security_bprm_set() and parts of
security_bprm_apply_creds() (these two have been removed).
Anything that might fail must be done at this point.
(iii) bprm->cred_prepared is set to 1.
bprm->cred_prepared is 0 on the first pass of the security
calculations, and 1 on all subsequent passes. This allows SELinux
in (ii) to base its calculations only on the initial script and
not on the interpreter.
(d) flush_old_exec() is called to commit the task to execution. This
performs the following steps with regard to credentials:
(i) Clear pdeath_signal and set dumpable on certain circumstances that
may not be covered by commit_creds().
(ii) Clear any bits in current->personality that were deferred from
(c.i).
(e) install_exec_creds() [compute_creds() as was] is called to install the
new credentials. This performs the following steps with regard to
credentials:
(i) Calls security_bprm_committing_creds() to apply any security
requirements, such as flushing unauthorised files in SELinux, that
must be done before the credentials are changed.
This is made up of bits of security_bprm_apply_creds() and
security_bprm_post_apply_creds(), both of which have been removed.
This function is not allowed to fail; anything that might fail
must have been done in (c.ii).
(ii) Calls commit_creds() to apply the new credentials in a single
assignment (more or less). Possibly pdeath_signal and dumpable
should be part of struct creds.
(iii) Unlocks the task's cred_replace_mutex, thus allowing
PTRACE_ATTACH to take place.
(iv) Clears The bprm->cred pointer as the credentials it was holding
are now immutable.
(v) Calls security_bprm_committed_creds() to apply any security
alterations that must be done after the creds have been changed.
SELinux uses this to flush signals and signal handlers.
(f) If an error occurs before (d.i), bprm_free() will call abort_creds()
to destroy the proposed new credentials and will then unlock
cred_replace_mutex. No changes to the credentials will have been
made.
(2) LSM interface.
A number of functions have been changed, added or removed:
(*) security_bprm_alloc(), ->bprm_alloc_security()
(*) security_bprm_free(), ->bprm_free_security()
Removed in favour of preparing new credentials and modifying those.
(*) security_bprm_apply_creds(), ->bprm_apply_creds()
(*) security_bprm_post_apply_creds(), ->bprm_post_apply_creds()
Removed; split between security_bprm_set_creds(),
security_bprm_committing_creds() and security_bprm_committed_creds().
(*) security_bprm_set(), ->bprm_set_security()
Removed; folded into security_bprm_set_creds().
(*) security_bprm_set_creds(), ->bprm_set_creds()
New. The new credentials in bprm->creds should be checked and set up
as appropriate. bprm->cred_prepared is 0 on the first call, 1 on the
second and subsequent calls.
(*) security_bprm_committing_creds(), ->bprm_committing_creds()
(*) security_bprm_committed_creds(), ->bprm_committed_creds()
New. Apply the security effects of the new credentials. This
includes closing unauthorised files in SELinux. This function may not
fail. When the former is called, the creds haven't yet been applied
to the process; when the latter is called, they have.
The former may access bprm->cred, the latter may not.
(3) SELinux.
SELinux has a number of changes, in addition to those to support the LSM
interface changes mentioned above:
(a) The bprm_security_struct struct has been removed in favour of using
the credentials-under-construction approach.
(c) flush_unauthorized_files() now takes a cred pointer and passes it on
to inode_has_perm(), file_has_perm() and dentry_open().
Signed-off-by: David Howells <dhowells@redhat.com>
Acked-by: James Morris <jmorris@namei.org>
Acked-by: Serge Hallyn <serue@us.ibm.com>
Signed-off-by: James Morris <jmorris@namei.org>
2008-11-14 02:39:24 +03:00
|
|
|
extern void install_exec_creds(struct linux_binprm *bprm);
|
2009-01-07 01:42:48 +03:00
|
|
|
extern void do_coredump(long signr, int exit_code, struct pt_regs *regs);
|
2005-04-17 02:20:36 +04:00
|
|
|
extern int set_binfmt(struct linux_binfmt *new);
|
2008-05-11 00:38:25 +04:00
|
|
|
extern void free_bprm(struct linux_binprm *);
|
2005-04-17 02:20:36 +04:00
|
|
|
|
|
|
|
|
#endif /* __KERNEL__ */
|
|
|
|
|
#endif /* _LINUX_BINFMTS_H */
|
