WSL2-Linux-Kernel/arch/um/drivers
Jann Horn 378c6520e7 fs/coredump: prevent fsuid=0 dumps into user-controlled directories
This commit fixes the following security hole affecting systems where
all of the following conditions are fulfilled:

 - The fs.suid_dumpable sysctl is set to 2.
 - The kernel.core_pattern sysctl's value starts with "/". (Systems
   where kernel.core_pattern starts with "|/" are not affected.)
 - Unprivileged user namespace creation is permitted. (This is
   true on Linux >=3.8, but some distributions disallow it by
   default using a distro patch.)

Under these conditions, if a program executes under secure exec rules,
causing it to run with the SUID_DUMP_ROOT flag, then unshares its user
namespace, changes its root directory and crashes, the coredump will be
written using fsuid=0 and a path derived from kernel.core_pattern - but
this path is interpreted relative to the root directory of the process,
allowing the attacker to control where a coredump will be written with
root privileges.

To fix the security issue, always interpret core_pattern for dumps that
are written under SUID_DUMP_ROOT relative to the root directory of init.

Signed-off-by: Jann Horn <jann@thejh.net>
Acked-by: Kees Cook <keescook@chromium.org>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: "Eric W. Biederman" <ebiederm@xmission.com>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Oleg Nesterov <oleg@redhat.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2016-03-22 15:36:02 -07:00
..
Makefile um: add ucast ethernet transport 2011-05-25 08:39:41 -07:00
chan.h um: Use tty_port in SIGWINCH handler 2013-03-11 10:08:04 +01:00
chan_kern.c Merge 3.9-rc3 into tty-next 2013-03-21 16:07:34 -07:00
chan_user.c um: Use tty_port in SIGWINCH handler 2013-03-11 10:08:04 +01:00
chan_user.h um: Use tty_port in SIGWINCH handler 2013-03-11 10:08:04 +01:00
cow.h um: switch cow_user.h to htobe{32,64}/betoh{32,64} 2012-04-10 00:13:45 +02:00
cow_sys.h um: get rid of pointless include "..." where include <...> will do 2012-10-09 22:28:45 +02:00
cow_user.c um: switch cow_user.h to htobe{32,64}/betoh{32,64} 2012-04-10 00:13:45 +02:00
daemon.h um: get rid of pointless include "..." where include <...> will do 2012-10-09 22:28:45 +02:00
daemon_kern.c um: get rid of pointless include "..." where include <...> will do 2012-10-09 22:28:45 +02:00
daemon_user.c um: get rid of pointless include "..." where include <...> will do 2012-10-09 22:28:45 +02:00
fd.c um: get rid of pointless include "..." where include <...> will do 2012-10-09 22:28:45 +02:00
harddog_kern.c Merge branch 'llseek' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/bkl 2010-10-22 10:52:56 -07:00
harddog_user.c um: Do not use stdin and stdout identifiers for struct members 2015-06-25 22:42:19 +02:00
hostaudio_kern.c [um] hostaudio: don't open-code memdup_user() 2016-01-04 10:29:40 -05:00
line.c uml: Fix unsafe pid reference to foreground process group 2014-11-05 16:26:13 -08:00
line.h um: get rid of pointless include "..." where include <...> will do 2012-10-09 22:28:45 +02:00
mconsole.h um: Stop abusing __KERNEL__ 2015-05-31 22:05:32 +02:00
mconsole_kern.c fs/coredump: prevent fsuid=0 dumps into user-controlled directories 2016-03-22 15:36:02 -07:00
mconsole_kern.h um: get rid of pointless include "..." where include <...> will do 2012-10-09 22:28:45 +02:00
mconsole_user.c um: -include user.h for USER_OBJ, trim includes 2011-11-02 14:14:44 +01:00
mmapper_kern.c um: get rid of pointless include "..." where include <...> will do 2012-10-09 22:28:45 +02:00
net_kern.c um: net: replace GFP_KERNEL with GFP_ATOMIC when spinlock is held 2015-11-06 22:51:00 +01:00
net_user.c um: fix returns without va_end 2015-12-08 22:26:00 +01:00
null.c um: get rid of pointless include "..." where include <...> will do 2012-10-09 22:28:45 +02:00
pcap_kern.c um: get rid of pointless include "..." where include <...> will do 2012-10-09 22:28:45 +02:00
pcap_user.c um: get rid of pointless include "..." where include <...> will do 2012-10-09 22:28:45 +02:00
pcap_user.h um: get rid of pointless include "..." where include <...> will do 2012-10-09 22:28:45 +02:00
port.h uml: remove useless comments 2009-04-01 08:59:17 -07:00
port_kern.c um: get rid of pointless include "..." where include <...> will do 2012-10-09 22:28:45 +02:00
port_user.c um: get rid of pointless include "..." where include <...> will do 2012-10-09 22:28:45 +02:00
pty.c um: get rid of pointless include "..." where include <...> will do 2012-10-09 22:28:45 +02:00
random.c sched, cleanup, treewide: Remove set_current_state(TASK_RUNNING) after schedule() 2014-09-19 12:35:17 +02:00
slip.h [PATCH] uml: const more data 2006-09-27 08:26:15 -07:00
slip_common.c um: get rid of pointless include "..." where include <...> will do 2012-10-09 22:28:45 +02:00
slip_common.h [PATCH] uml: fix hugest stack users 2006-02-01 08:53:22 -08:00
slip_kern.c um: get rid of pointless include "..." where include <...> will do 2012-10-09 22:28:45 +02:00
slip_user.c um: Do not use stdin and stdout identifiers for struct members 2015-06-25 22:42:19 +02:00
slirp.h [PATCH] uml: const more data 2006-09-27 08:26:15 -07:00
slirp_kern.c um: get rid of pointless include "..." where include <...> will do 2012-10-09 22:28:45 +02:00
slirp_user.c um: Do not use stdin and stdout identifiers for struct members 2015-06-25 22:42:19 +02:00
ssl.c um: Use tty_port_operations->destruct 2013-03-11 10:08:03 +01:00
ssl.h uml: remove useless comments 2009-04-01 08:59:17 -07:00
stderr_console.c spelling fixes: arch/um/ 2007-10-20 01:23:03 +02:00
stdio_console.c um: Use tty_port_operations->destruct 2013-03-11 10:08:03 +01:00
stdio_console.h uml: remove useless comments 2009-04-01 08:59:17 -07:00
tty.c um: get rid of pointless include "..." where include <...> will do 2012-10-09 22:28:45 +02:00
ubd.h um: Cleanup SIGTERM handling 2013-09-07 10:56:58 +02:00
ubd_kern.c um: Update UBD to use pread/pwrite family of functions 2016-01-10 21:49:48 +01:00
ubd_user.c um: Cleanup SIGTERM handling 2013-09-07 10:56:58 +02:00
umcast.h um: get rid of pointless include "..." where include <...> will do 2012-10-09 22:28:45 +02:00
umcast_kern.c um: get rid of pointless include "..." where include <...> will do 2012-10-09 22:28:45 +02:00
umcast_user.c um: get rid of pointless include "..." where include <...> will do 2012-10-09 22:28:45 +02:00
vde.h uml: add VDE networking support 2007-10-16 09:43:05 -07:00
vde_kern.c um: get rid of pointless include "..." where include <...> will do 2012-10-09 22:28:45 +02:00
vde_user.c um: get rid of pointless include "..." where include <...> will do 2012-10-09 22:28:45 +02:00
xterm.c um: get rid of pointless include "..." where include <...> will do 2012-10-09 22:28:45 +02:00
xterm.h uml: remove useless comments 2009-04-01 08:59:17 -07:00
xterm_kern.c um: get rid of pointless include "..." where include <...> will do 2012-10-09 22:28:45 +02:00