Currently one can write to shared libraries while these are mapped. That means shared library code can not be trusted as after signature verification, one can overwrite the code. Till we find a way to take care of that issue, do not mark a process signed if it has interpreter which in turn will load shared librareis. This does not take care of application doing dlopen(). Just that be careful while signing applications and don't sign anything which does dlopen(). Signed-off-by: Vivek Goyal <vgoyal@xxxxxxxxxx> --- fs/binfmt_elf.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c index 839fc86..259e17c 100644 --- a/fs/binfmt_elf.c +++ b/fs/binfmt_elf.c @@ -982,8 +982,16 @@ static int load_elf_binary(struct linux_binprm *bprm) * not signed, do not set proc_signed, otherwise unsigned * tracer could change signed tracee's address space, * effectively nullifying singature checking. + * + * Also set proc_signed only if there is no elf interpreter. + * We don't have a way to avoid writes to shared libraries + * after they have been mapped. That means anybody can + * write to library after signature verification. So don't + * trust executables which are dynamically linked. This + * does not cover dlopen() and friends. So don't sign + * applications using dlopen(). */ - if (!ptraced_by_unsafe_tracer()) + if (!ptraced_by_unsafe_tracer() && !elf_interpreter) bprm->cred->proc_signed = true; } #endif -- 1.8.3.1 _______________________________________________ kernel mailing list kernel@xxxxxxxxxxxxxxxxxxxxxxx https://admin.fedoraproject.org/mailman/listinfo/kernel
