The patch titled
Subject: ipc/sem: introduce semctl(SEM_STAT_ANY)
has been removed from the -mm tree. Its filename was
ipc-sem-introduce-semctlsem_stat_any.patch
This patch was dropped because it was merged into mainline or a subsystem tree
------------------------------------------------------
From: Davidlohr Bueso <dave@xxxxxxxxxxxx>
Subject: ipc/sem: introduce semctl(SEM_STAT_ANY)
There is a permission discrepancy when consulting shm ipc object metadata
between /proc/sysvipc/sem (0444) and the SEM_STAT semctl command. The
later does permission checks for the object vs S_IRUGO. As such there can
be cases where EACCESS is returned via syscall but the info is displayed
anyways in the procfs files.
While this might have security implications via info leaking (albeit no
writing to the sma metadata), this behavior goes way back and showing all
the objects regardless of the permissions was most likely an overlook - so
we are stuck with it. Furthermore, modifying either the syscall or the
procfs file can cause userspace programs to break (ie ipcs). Some
applications require getting the procfs info (without root privileges) and
can be rather slow in comparison with a syscall -- up to 500x in some
reported cases for shm.
This patch introduces a new SEM_STAT_ANY command such that the sem ipc
object permissions are ignored, and only audited instead. In addition,
I've left the lsm security hook checks in place, as if some policy can
block the call, then the user has no other choice than just parsing the
procfs file.
Link: http://lkml.kernel.org/r/20180215162458.10059-3-dave@xxxxxxxxxxxx
Signed-off-by: Davidlohr Bueso <dbueso@xxxxxxx>
Reported-by: Robert Kettler <robert.kettler@xxxxxxxxxxx>
Cc: Eric W. Biederman <ebiederm@xxxxxxxxxxxx>
Cc: Kees Cook <keescook@xxxxxxxxxxxx>
Cc: Manfred Spraul <manfred@xxxxxxxxxxxxxxxx>
Cc: Michael Kerrisk <mtk.manpages@xxxxxxxxx>
Cc: Michal Hocko <mhocko@xxxxxxxxxx>
Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
---
include/uapi/linux/sem.h | 1 +
ipc/sem.c | 17 ++++++++++++-----
security/selinux/hooks.c | 1 +
security/smack/smack_lsm.c | 1 +
4 files changed, 15 insertions(+), 5 deletions(-)
diff -puN include/uapi/linux/sem.h~ipc-sem-introduce-semctlsem_stat_any include/uapi/linux/sem.h
--- a/include/uapi/linux/sem.h~ipc-sem-introduce-semctlsem_stat_any
+++ a/include/uapi/linux/sem.h
@@ -19,6 +19,7 @@
/* ipcs ctl cmds */
#define SEM_STAT 18
#define SEM_INFO 19
+#define SEM_STAT_ANY 20
/* Obsolete, used only for backwards compatibility and libc5 compiles */
struct semid_ds {
diff -puN ipc/sem.c~ipc-sem-introduce-semctlsem_stat_any ipc/sem.c
--- a/ipc/sem.c~ipc-sem-introduce-semctlsem_stat_any
+++ a/ipc/sem.c
@@ -1220,14 +1220,14 @@ static int semctl_stat(struct ipc_namesp
memset(semid64, 0, sizeof(*semid64));
rcu_read_lock();
- if (cmd == SEM_STAT) {
+ if (cmd == SEM_STAT || cmd == SEM_STAT_ANY) {
sma = sem_obtain_object(ns, semid);
if (IS_ERR(sma)) {
err = PTR_ERR(sma);
goto out_unlock;
}
id = sma->sem_perm.id;
- } else {
+ } else { /* IPC_STAT */
sma = sem_obtain_object_check(ns, semid);
if (IS_ERR(sma)) {
err = PTR_ERR(sma);
@@ -1235,9 +1235,14 @@ static int semctl_stat(struct ipc_namesp
}
}
- err = -EACCES;
- if (ipcperms(ns, &sma->sem_perm, S_IRUGO))
- goto out_unlock;
+ /* see comment for SHM_STAT_ANY */
+ if (cmd == SEM_STAT_ANY)
+ audit_ipc_obj(&sma->sem_perm);
+ else {
+ err = -EACCES;
+ if (ipcperms(ns, &sma->sem_perm, S_IRUGO))
+ goto out_unlock;
+ }
err = security_sem_semctl(&sma->sem_perm, cmd);
if (err)
@@ -1626,6 +1631,7 @@ long ksys_semctl(int semid, int semnum,
return semctl_info(ns, semid, cmd, p);
case IPC_STAT:
case SEM_STAT:
+ case SEM_STAT_ANY:
err = semctl_stat(ns, semid, cmd, &semid64);
if (err < 0)
return err;
@@ -1732,6 +1738,7 @@ long compat_ksys_semctl(int semid, int s
return semctl_info(ns, semid, cmd, p);
case IPC_STAT:
case SEM_STAT:
+ case SEM_STAT_ANY:
err = semctl_stat(ns, semid, cmd, &semid64);
if (err < 0)
return err;
diff -puN security/selinux/hooks.c~ipc-sem-introduce-semctlsem_stat_any security/selinux/hooks.c
--- a/security/selinux/hooks.c~ipc-sem-introduce-semctlsem_stat_any
+++ a/security/selinux/hooks.c
@@ -6273,6 +6273,7 @@ static int selinux_sem_semctl(struct ker
break;
case IPC_STAT:
case SEM_STAT:
+ case SEM_STAT_ANY:
perms = SEM__GETATTR | SEM__ASSOCIATE;
break;
default:
diff -puN security/smack/smack_lsm.c~ipc-sem-introduce-semctlsem_stat_any security/smack/smack_lsm.c
--- a/security/smack/smack_lsm.c~ipc-sem-introduce-semctlsem_stat_any
+++ a/security/smack/smack_lsm.c
@@ -3140,6 +3140,7 @@ static int smack_sem_semctl(struct kern_
case GETALL:
case IPC_STAT:
case SEM_STAT:
+ case SEM_STAT_ANY:
may = MAY_READ;
break;
case SETVAL:
_
Patches currently in -mm which might be from dave@xxxxxxxxxxxx are
--
To unsubscribe from this list: send the line "unsubscribe mm-commits" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
