android_kernel_oneplus_msm8998/arch/um
Jann Horn 74b23f79f1 fs/coredump: prevent fsuid=0 dumps into user-controlled directories
commit 378c6520e7d29280f400ef2ceaf155c86f05a71a upstream.

This commit fixes the following security hole affecting systems where
all of the following conditions are fulfilled:

 - The fs.suid_dumpable sysctl is set to 2.
 - The kernel.core_pattern sysctl's value starts with "/". (Systems
   where kernel.core_pattern starts with "|/" are not affected.)
 - Unprivileged user namespace creation is permitted. (This is
   true on Linux >=3.8, but some distributions disallow it by
   default using a distro patch.)

Under these conditions, if a program executes under secure exec rules,
causing it to run with the SUID_DUMP_ROOT flag, then unshares its user
namespace, changes its root directory and crashes, the coredump will be
written using fsuid=0 and a path derived from kernel.core_pattern - but
this path is interpreted relative to the root directory of the process,
allowing the attacker to control where a coredump will be written with
root privileges.

To fix the security issue, always interpret core_pattern for dumps that
are written under SUID_DUMP_ROOT relative to the root directory of init.

Signed-off-by: Jann Horn <jann@thejh.net>
Acked-by: Kees Cook <keescook@chromium.org>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: "Eric W. Biederman" <ebiederm@xmission.com>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2016-04-12 09:08:58 -07:00
..
configs arch/um: make it work with defconfig and x86_64 2013-11-17 11:31:48 +01:00
drivers fs/coredump: prevent fsuid=0 dumps into user-controlled directories 2016-04-12 09:08:58 -07:00
include um: Switch clocksource to hrtimers 2015-11-06 22:54:49 +01:00
kernel um: Fix get_signal() usage 2015-12-08 22:23:30 +01:00
os-Linux uml: flush stdout before forking 2016-03-03 15:07:12 -08:00
scripts um: Preinclude include/linux/kern_levels.h 2012-09-27 20:20:09 +02:00
.gitignore um: tell git to ignore generated files 2010-03-06 11:26:28 -08:00
Kconfig.char um: remove used STDIO_CONSOLE Kconfig param 2013-11-17 11:32:27 +01:00
Kconfig.common um: Skip futex_atomic_cmpxchg_inatomic() test 2015-01-04 14:20:26 +01:00
Kconfig.debug lib: consolidate DEBUG_STACK_USAGE option 2011-05-25 08:39:54 -07:00
Kconfig.net arch/um: remove depends on CONFIG_EXPERIMENTAL 2013-01-11 11:38:04 -08:00
Kconfig.rest um: switch to use of drivers/Kconfig 2011-11-02 14:15:41 +01:00
Kconfig.um um: Fix mconsole dependency 2015-05-31 23:27:26 +02:00
Makefile arch: um: fix error when linking vmlinux. 2015-12-08 22:25:13 +01:00
Makefile-os-Linux x86, um: get rid of arch/um/os symlink 2008-10-22 22:55:22 -07:00
Makefile-skas