Currently one can write to shared libraries while these are mapped. That means shared library code can not be trusted as after signature verification, one can overwrite the code. Till we find a way to take care of that issue, do not mark a process signed if it has interpreter which in turn will load shared librareis. This does not take care of application doing dlopen(). Just that be careful while signing applications and don't sign anything which does dlopen(). Signed-off-by: Vivek Goyal <vgoyal at redhat.com> --- fs/binfmt_elf.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c index 8f2286e..52f8bd2 100644 --- a/fs/binfmt_elf.c +++ b/fs/binfmt_elf.c @@ -995,8 +995,16 @@ static int load_elf_binary(struct linux_binprm *bprm) * not signed, do not set proc_signed, otherwise unsigned * tracer could change signed tracee's address space, * effectively nullifying singature checking. + * + * Also set proc_signed only if there is no elf interpreter. + * We don't have a way to avoid writes to shared libraries + * after they have been mapped. That means anybody can + * write to library after signature verification. So don't + * trust executables which are dynamically linked. This + * does not cover dlopen() and friends. So don't sign + * applications using dlopen(). */ - if (!ptraced_by_unsafe_tracer()) + if (!ptraced_by_unsafe_tracer() && !elf_interpreter) bprm->cred->proc_signed = true; } #endif -- 1.8.3.1
