[PATCH] timekeeping: Require permission to set auxiliary clocks

[PATCH] timekeeping: Require permission to set auxiliary clocks

[Daehyeon Ko]

The generic clock_settime() entry point delegates permission checks to
each clock-specific callback. aux_clock_set() does not perform one. Once
an administrator enables an auxiliary clock, any local process can
therefore change the global clock offset.

A test process running as UID and GID 65534 with no effective, permitted,
inheritable, or ambient capabilities set CLOCK_AUX0 successfully, and a
separate process observed the new value. The same process was denied by
clock_adjtime(). An AppArmor profile denying sys_time also blocked
CLOCK_REALTIME changes but did not see the auxiliary clock operation.

Call security_settime64() before mutating the auxiliary timekeeper. This
matches CLOCK_REALTIME's permission model, enforces initial-user-namespace
CAP_SYS_TIME, and gives LSMs the settime hook while preserving authorized
clock changes.

Fixes: 60ecc26ec5af ("timekeeping: Provide time setter for auxiliary clocks")
Cc: stable@vger.kernel.org
Signed-off-by: Daehyeon Ko <4ncienth@gmail.com>
---
AI assistance was used for source analysis, reproducer development, and
validation. The submitter reviewed the resulting change before signing it.

 kernel/time/timekeeping.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
index ea2e6e55f37bf..1b342825bd8f1 100644
--- a/kernel/time/timekeeping.c
+++ b/kernel/time/timekeeping.c
@@ -14,6 +14,7 @@
 #include <linux/random.h>
 #include <linux/sched/clock.h>
 #include <linux/sched/loadavg.h>
+#include <linux/security.h>
 #include <linux/static_key.h>
 #include <linux/stop_machine.h>
 #include <linux/syscore_ops.h>
@@ -3215,11 +3216,15 @@ static int aux_clock_set(const clockid_t id, const struct timespec64 *tnew)
 	struct tk_data *aux_tkd = aux_get_tk_data(id);
 	struct timekeeper *aux_tks;
 	ktime_t tnow, nsecs;
+	int ret;
 
 	if (!timespec64_valid_settod(tnew))
 		return -EINVAL;
 	if (!aux_tkd)
 		return -ENODEV;
+	ret = security_settime64(tnew, NULL);
+	if (ret)
+		return ret;
 
 	aux_tks = &aux_tkd->shadow_timekeeper;
 

base-commit: c03c1a14507dfaf8b856c2608f9ac216021fc222
-- 
2.55.0

Re: [PATCH] timekeeping: Require permission to set auxiliary clocks

[shaos]

I tested this patch on x86_64 using QEMU TCG, with the reproduction
configuration and PoC from my report. The patch applied cleanly to
c03c1a14507dfaf8b856c2608f9ac216021fc222, and the kernel built and
booted successfully.

With the patch applied, an unprivileged process (uid 65534, with
CapEff=0) receives EPERM when calling clock_settime(CLOCK_AUX0) after
the clock has been enabled. An additional privileged control call
successfully set CLOCK_AUX0. The CLOCK_REALTIME settime and
CLOCK_AUX0 adjtime controls returned EPERM as expected.

For completeness, setting the disabled CLOCK_AUX1 as an unprivileged
caller also returned EPERM; the permission check runs before the
enabled-clock check.

Tested-by: shaos <shawnq1@163.com>

Re: [PATCH] timekeeping: Require permission to set auxiliary clocks

[John Stultz]

On Mon, Oct 19, 2026 at 1:03 AM Daehyeon Ko <4ncienth@gmail.com> wrote:
>
> The generic clock_settime() entry point delegates permission checks to
> each clock-specific callback. aux_clock_set() does not perform one. Once
> an administrator enables an auxiliary clock, any local process can
> therefore change the global clock offset.
>
> A test process running as UID and GID 65534 with no effective, permitted,
> inheritable, or ambient capabilities set CLOCK_AUX0 successfully, and a
> separate process observed the new value. The same process was denied by
> clock_adjtime(). An AppArmor profile denying sys_time also blocked
> CLOCK_REALTIME changes but did not see the auxiliary clock operation.
>
> Call security_settime64() before mutating the auxiliary timekeeper. This
> matches CLOCK_REALTIME's permission model, enforces initial-user-namespace
> CAP_SYS_TIME, and gives LSMs the settime hook while preserving authorized
> clock changes.
>
> Fixes: 60ecc26ec5af ("timekeeping: Provide time setter for auxiliary clocks")
> Cc: stable@vger.kernel.org
> Signed-off-by: Daehyeon Ko <4ncienth@gmail.com>
> ---
> AI assistance was used for source analysis, reproducer development, and
> validation. The submitter reviewed the resulting change before signing it.
>
>  kernel/time/timekeeping.c | 5 +++++
>  1 file changed, 5 insertions(+)
>
> diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
> index ea2e6e55f37bf..1b342825bd8f1 100644
> --- a/kernel/time/timekeeping.c
> +++ b/kernel/time/timekeeping.c
> @@ -14,6 +14,7 @@
>  #include <linux/random.h>
>  #include <linux/sched/clock.h>
>  #include <linux/sched/loadavg.h>
> +#include <linux/security.h>
>  #include <linux/static_key.h>
>  #include <linux/stop_machine.h>
>  #include <linux/syscore_ops.h>
> @@ -3215,11 +3216,15 @@ static int aux_clock_set(const clockid_t id, const struct timespec64 *tnew)
>         struct tk_data *aux_tkd = aux_get_tk_data(id);
>         struct timekeeper *aux_tks;
>         ktime_t tnow, nsecs;
> +       int ret;
>
>         if (!timespec64_valid_settod(tnew))
>                 return -EINVAL;
>         if (!aux_tkd)
>                 return -ENODEV;
> +       ret = security_settime64(tnew, NULL);
> +       if (ret)
> +               return ret;
>
>         aux_tks = &aux_tkd->shadow_timekeeper;

This looked a little odd adding the security_settime64() check in the
core timekeeping.c where as is usually called closer to the syscall in
time.c, but given the clock_aux k_clock is defined in timekeeping.c, I
guess this makes it the best place to add the check.

Acked-by: John Stultz <jstultz@google.com>

thanks
-john

Re: [PATCH] timekeeping: Require permission to set auxiliary clocks

[Thomas Gleixner]

On Wed, Oct 21 2026 at 11:29, John Stultz wrote:
> On Mon, Oct 19, 2026 at 1:03 AM Daehyeon Ko <4ncienth@gmail.com> wrote:
>> +       ret = security_settime64(tnew, NULL);
>> +       if (ret)
>> +               return ret;
>>
>>         aux_tks = &aux_tkd->shadow_timekeeper;
>
> This looked a little odd adding the security_settime64() check in the
> core timekeeping.c where as is usually called closer to the syscall in
> time.c, but given the clock_aux k_clock is defined in timekeeping.c, I
> guess this makes it the best place to add the check.

The reason why it's not in the syscall is that posix clocks have a
different permission scheme than system time, so the check ends up in
the clock_set() callback of the individial clocks.

[tip: timers/urgent] timekeeping: Require permission to set auxiliary clocks

[tip-bot2 for Daehyeon Ko]

The following commit has been merged into the timers/urgent branch of tip:

Commit-ID:     524d95c8a2000cba6cb80a173d76cb746c561244
Gitweb:        https://git.kernel.org/tip/524d95c8a2000cba6cb80a173d76cb746c561244
Author:        Daehyeon Ko <4ncienth@gmail.com>
AuthorDate:    Mon, 19 Oct 2026 17:03:24 +09:00
Committer:     Thomas Gleixner <tglx@kernel.org>
CommitterDate: Fri, 23 Oct 2026 21:49:57 +02:00

timekeeping: Require permission to set auxiliary clocks

The generic clock_settime() entry point delegates permission checks to
each clock-specific callback. aux_clock_set() does not perform one. Once
an administrator enables an auxiliary clock, any local process can
therefore change the global clock offset.

A test process running as UID and GID 65534 with no effective, permitted,
inheritable, or ambient capabilities set CLOCK_AUX0 successfully, and a
separate process observed the new value. The same process was denied by
clock_adjtime(). An AppArmor profile denying sys_time also blocked
CLOCK_REALTIME changes but did not see the auxiliary clock operation.

Call security_settime64() before mutating the auxiliary timekeeper. This
matches CLOCK_REALTIME's permission model, enforces initial-user-namespace
CAP_SYS_TIME, and gives LSMs the settime hook while preserving authorized
clock changes.

Fixes: 60ecc26ec5af ("timekeeping: Provide time setter for auxiliary clocks")
Signed-off-by: Daehyeon Ko <4ncienth@gmail.com>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Tested-by: shaos <shawnq1@163.com>
Acked-by: John Stultz <jstultz@google.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20261019080324.4147815-1-4ncienth@gmail.com
---
 kernel/time/timekeeping.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
index ea2e6e5..1b34282 100644
--- a/kernel/time/timekeeping.c
+++ b/kernel/time/timekeeping.c
@@ -14,6 +14,7 @@
 #include <linux/random.h>
 #include <linux/sched/clock.h>
 #include <linux/sched/loadavg.h>
+#include <linux/security.h>
 #include <linux/static_key.h>
 #include <linux/stop_machine.h>
 #include <linux/syscore_ops.h>
@@ -3215,11 +3216,15 @@ static int aux_clock_set(const clockid_t id, const struct timespec64 *tnew)
 	struct tk_data *aux_tkd = aux_get_tk_data(id);
 	struct timekeeper *aux_tks;
 	ktime_t tnow, nsecs;
+	int ret;
 
 	if (!timespec64_valid_settod(tnew))
 		return -EINVAL;
 	if (!aux_tkd)
 		return -ENODEV;
+	ret = security_settime64(tnew, NULL);
+	if (ret)
+		return ret;
 
 	aux_tks = &aux_tkd->shadow_timekeeper;