From mboxrd@z Thu Jan 1 00:00:00 1970 From: Oleg Nesterov Subject: [PATCH 0/3] get/set_dumpable() cleanups and theoretical fix Date: Sat, 16 Nov 2013 20:00:57 +0100 Message-ID: <20131116190057.GA22666@redhat.com> References: <20131101232521.GA23119@www.outflux.net> <20131114170337.GA11068@redhat.com> <20131115203652.GA13476@redhat.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Return-path: Received: from mx1.redhat.com ([209.132.183.28]:17476 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751483Ab3KPTEA (ORCPT ); Sat, 16 Nov 2013 14:04:00 -0500 Content-Disposition: inline In-Reply-To: Sender: linux-arch-owner@vger.kernel.org List-ID: To: Kees Cook , Andrew Morton Cc: "security@kernel.org" , "Eric W. Biederman" , Vasily Kulikov , Petr Matousek , linux-kernel@vger.kernel.org, linux-arch@vger.kernel.org, Alex Kelly , Josh Triplett On 11/15, Kees Cook wrote: > > On Fri, Nov 15, 2013 at 12:36 PM, Oleg Nesterov wrote: > > > > unless I missed something, this is the fix, not cleanup ? > > > > If commit_creds()->set_dumpable(SUID_DUMP_ROOT) races with > > sys_prctl()->set_dumpable(SUID_DUMP_DISABLE), we can get > > SUID_DUMP_USER afaics. > > > > Yes, yes, even if I am right this race is very unlikely. > > Hm, yes, that is a fix then. I struggle to imagine it being > exploitable (i.e. control over both threads, one at least already with > a different cred, etc), but it certainly does look like a bug. Yes, yes, sure, this is only theoretical. OK, I am sending the patches to lkml. I didn't dare to keep your ack, please review v2 (v1 confused bit-mask with bit-number, and in theory we need ACCESS_ONCE). It would be really nice if someone can ack the "it is safe to mix bitops and cmpxchg" assumption mentioned in the changelog. Alex, Josh, this also partly reverts 179899fd5dc780fe "coredump: update coredump-related headers", I think fs/coredump.h buys nothing. Oleg. fs/coredump.c | 1 - fs/coredump.h | 6 ----- fs/exec.c | 61 +++++-------------------------------------------- include/linux/sched.h | 25 ++++++++++++++----- 4 files changed, 24 insertions(+), 69 deletions(-)