Commit 259e5e6c authored by Andy Lutomirski's avatar Andy Lutomirski Committed by James Morris
Browse files

Add PR_{GET,SET}_NO_NEW_PRIVS to prevent execve from granting privs 



With this change, calling
  prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)
disables privilege granting operations at execve-time.  For example, a
process will not be able to execute a setuid binary to change their uid
or gid if this bit is set.  The same is true for file capabilities.

Additionally, LSM_UNSAFE_NO_NEW_PRIVS is defined to ensure that
LSMs respect the requested behavior.

To determine if the NO_NEW_PRIVS bit is set, a task may call
  prctl(PR_GET_NO_NEW_PRIVS, 0, 0, 0, 0);
It returns 1 if set and 0 if it is not set. If any of the arguments are
non-zero, it will return -1 and set errno to -EINVAL.
(PR_SET_NO_NEW_PRIVS behaves similarly.)

This functionality is desired for the proposed seccomp filter patch
series.  By using PR_SET_NO_NEW_PRIVS, it allows a task to modify the
system call behavior for itself and its child tasks without being
able to impact the behavior of a more privileged task.

Another potential use is making certain privileged operations
unprivileged.  For example, chroot may be considered "safe" if it cannot
affect privileged tasks.

Note, this patch causes execve to fail when PR_SET_NO_NEW_PRIVS is
set and AppArmor is in use.  It is fixed in a subsequent patch.

Signed-off-by: default avatarAndy Lutomirski <luto@amacapital.net>
Signed-off-by: default avatarWill Drewry <wad@chromium.org>
Acked-by: default avatarEric Paris <eparis@redhat.com>
Acked-by: default avatarKees Cook <keescook@chromium.org>

v18: updated change desc
v17: using new define values as per 3.4
Signed-off-by: default avatarJames Morris <james.l.morris@oracle.com>
parent 9ccf010f

fs/exec.c

+9 −1
Original line number Diff line number Diff line
@@ -1245,6 +1245,13 @@ static int check_unsafe_exec(struct linux_binprm *bprm) 
			bprm->unsafe |= LSM_UNSAFE_PTRACE;

	}



	/*

	 * This isn't strictly necessary, but it makes it harder for LSMs to

	 * mess up.

	 */

	if (current->no_new_privs)

		bprm->unsafe |= LSM_UNSAFE_NO_NEW_PRIVS;



	n_fs = 1;

	spin_lock(&p->fs->lock);

	rcu_read_lock();
@@ -1288,7 +1295,8 @@ int prepare_binprm(struct linux_binprm *bprm) 
	bprm->cred->euid = current_euid();

	bprm->cred->egid = current_egid();



	if (!(bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID)) {

	if (!(bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID) &&

	    !current->no_new_privs) {

		/* Set-uid? */

		if (mode & S_ISUID) {

			bprm->per_clear |= PER_CLEAR_ON_SETID;

include/linux/prctl.h

+15 −0
Original line number Diff line number Diff line
@@ -124,4 +124,19 @@ 
#define PR_SET_CHILD_SUBREAPER 36

#define PR_GET_CHILD_SUBREAPER 37



/*

 * If no_new_privs is set, then operations that grant new privileges (i.e.

 * execve) will either fail or not grant them.  This affects suid/sgid,

 * file capabilities, and LSMs.

 *

 * Operations that merely manipulate or drop existing privileges (setresuid,

 * capset, etc.) will still work.  Drop those privileges if you want them gone.

 *

 * Changing LSM security domain is considered a new privilege.  So, for example,

 * asking selinux for a specific new context (e.g. with runcon) will result

 * in execve returning -EPERM.

 */

#define PR_SET_NO_NEW_PRIVS 38

#define PR_GET_NO_NEW_PRIVS 39



#endif /* _LINUX_PRCTL_H */

include/linux/sched.h

+2 −0
Original line number Diff line number Diff line
@@ -1341,6 +1341,8 @@ struct task_struct { 
				 * execve */

	unsigned in_iowait:1;



	/* task may not gain privileges */

	unsigned no_new_privs:1;



	/* Revert to default priority/policy when forking */

	unsigned sched_reset_on_fork:1;

include/linux/security.h

+1 −0
Original line number Diff line number Diff line
@@ -144,6 +144,7 @@ struct request_sock; 
#define LSM_UNSAFE_SHARE	1

#define LSM_UNSAFE_PTRACE	2

#define LSM_UNSAFE_PTRACE_CAP	4

#define LSM_UNSAFE_NO_NEW_PRIVS	8



#ifdef CONFIG_MMU

extern int mmap_min_addr_handler(struct ctl_table *table, int write,

kernel/sys.c

+10 −0
Original line number Diff line number Diff line
@@ -1979,6 +1979,16 @@ SYSCALL_DEFINE5(prctl, int, option, unsigned long, arg2, unsigned long, arg3, 
			error = put_user(me->signal->is_child_subreaper,

					 (int __user *) arg2);

			break;

		case PR_SET_NO_NEW_PRIVS:

			if (arg2 != 1 || arg3 || arg4 || arg5)

				return -EINVAL;



			current->no_new_privs = 1;

			break;

		case PR_GET_NO_NEW_PRIVS:

			if (arg2 || arg3 || arg4 || arg5)

				return -EINVAL;

			return current->no_new_privs ? 1 : 0;

		default:

			error = -EINVAL;

			break;

CRA Git | Maintained and supported by SUSTech CRA and CCSE