Commit 1d4457f9 authored by Kees Cook's avatar Kees Cook
Browse files

sched: move no_new_privs into new atomic flags 



Since seccomp transitions between threads requires updates to the
no_new_privs flag to be atomic, the flag must be part of an atomic flag
set. This moves the nnp flag into a separate task field, and introduces
accessors.

Signed-off-by: default avatarKees Cook <keescook@chromium.org>
Reviewed-by: default avatarOleg Nesterov <oleg@redhat.com>
Reviewed-by: default avatarAndy Lutomirski <luto@amacapital.net>
parent 8855d608

fs/exec.c

+2 −2
Original line number Diff line number Diff line
@@ -1234,7 +1234,7 @@ static void check_unsafe_exec(struct linux_binprm *bprm) 
	 * This isn't strictly necessary, but it makes it harder for LSMs to

	 * mess up.

	 */

	if (current->no_new_privs)

	if (task_no_new_privs(current))

		bprm->unsafe |= LSM_UNSAFE_NO_NEW_PRIVS;



	t = p;
@@ -1272,7 +1272,7 @@ int prepare_binprm(struct linux_binprm *bprm) 
	bprm->cred->egid = current_egid();



	if (!(bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID) &&

	    !current->no_new_privs &&

	    !task_no_new_privs(current) &&

	    kuid_has_mapping(bprm->cred->user_ns, inode->i_uid) &&

	    kgid_has_mapping(bprm->cred->user_ns, inode->i_gid)) {

		/* Set-uid? */

include/linux/sched.h

+15 −3
Original line number Diff line number Diff line
@@ -1307,13 +1307,12 @@ struct task_struct { 
				 * execve */

	unsigned in_iowait:1;



	/* task may not gain privileges */

	unsigned no_new_privs:1;



	/* Revert to default priority/policy when forking */

	unsigned sched_reset_on_fork:1;

	unsigned sched_contributes_to_load:1;



	unsigned long atomic_flags; /* Flags needing atomic access. */



	pid_t pid;

	pid_t tgid;
@@ -1967,6 +1966,19 @@ static inline void memalloc_noio_restore(unsigned int flags) 
	current->flags = (current->flags & ~PF_MEMALLOC_NOIO) | flags;

}



/* Per-process atomic flags. */

#define PFA_NO_NEW_PRIVS 0x00000001	/* May not gain new privileges. */



static inline bool task_no_new_privs(struct task_struct *p)

{

	return test_bit(PFA_NO_NEW_PRIVS, &p->atomic_flags);

}



static inline void task_set_no_new_privs(struct task_struct *p)

{

	set_bit(PFA_NO_NEW_PRIVS, &p->atomic_flags);

}



/*

 * task->jobctl flags

 */

kernel/seccomp.c

+1 −1
Original line number Diff line number Diff line
@@ -241,7 +241,7 @@ static long seccomp_attach_filter(struct sock_fprog *fprog) 
	 * This avoids scenarios where unprivileged tasks can affect the

	 * behavior of privileged children.

	 */

	if (!current->no_new_privs &&

	if (!task_no_new_privs(current) &&

	    security_capable_noaudit(current_cred(), current_user_ns(),

				     CAP_SYS_ADMIN) != 0)

		return -EACCES;

kernel/sys.c

+2 −2
Original line number Diff line number Diff line
@@ -1990,12 +1990,12 @@ SYSCALL_DEFINE5(prctl, int, option, unsigned long, arg2, unsigned long, arg3, 
		if (arg2 != 1 || arg3 || arg4 || arg5)

			return -EINVAL;



		current->no_new_privs = 1;

		task_set_no_new_privs(current);

		break;

	case PR_GET_NO_NEW_PRIVS:

		if (arg2 || arg3 || arg4 || arg5)

			return -EINVAL;

		return current->no_new_privs ? 1 : 0;

		return task_no_new_privs(current) ? 1 : 0;

	case PR_GET_THP_DISABLE:

		if (arg2 || arg3 || arg4 || arg5)

			return -EINVAL;

security/apparmor/domain.c

+2 −2
Original line number Diff line number Diff line
@@ -621,7 +621,7 @@ int aa_change_hat(const char *hats[], int count, u64 token, bool permtest) 
	 * There is no exception for unconfined as change_hat is not

	 * available.

	 */

	if (current->no_new_privs)

	if (task_no_new_privs(current))

		return -EPERM;



	/* released below */
@@ -776,7 +776,7 @@ int aa_change_profile(const char *ns_name, const char *hname, bool onexec, 
	 * no_new_privs is set because this aways results in a reduction

	 * of permissions.

	 */

	if (current->no_new_privs && !unconfined(profile)) {

	if (task_no_new_privs(current) && !unconfined(profile)) {

		put_cred(cred);

		return -EPERM;

	}

CRA Git | Maintained and supported by SUSTech CRA and CCSE