linux-fsdevel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Zach Levis <zml@linux.vnet.ibm.com>
To: akpm@linux-foundation.org, oleg@redhat.com
Cc: viro@zeniv.linux.org.uk, linux-kernel@vger.kernel.org,
	linux-fsdevel@vger.kernel.org, dan.carpenter@oracle.com,
	Zach Levis <zml@linux.vnet.ibm.com>,
	Zach Levis <zach@zachsthings.com>
Subject: [PATCH v2 2/3] fs/binfmts: Better handling of binfmt loops
Date: Fri,  2 Aug 2013 15:12:14 -0700	[thread overview]
Message-ID: <1375481535-20034-3-git-send-email-zml@linux.vnet.ibm.com> (raw)
In-Reply-To: <1374766845-13565-1-git-send-email-zml@linux.vnet.ibm.com>

With these changes, when a binfmt loop is encountered,
the ELOOP will propogate back to the 0 depth. At this point the
argv and argc values will be reset to what they were originally and an
attempt is made to continue with the following binfmt handlers.

Example: a qemu is configured to run 64-bit ELFs on an otherwise 32-bit
system. The system's owner switches to running with 64-bit executables,
but forgets to disable the binfmt_misc option that redirects 64bit ELFs
to qemu. Since the qemu executable is a 64-bit ELF now, binfmt_misc
keeps on matching it with the qemu rule, preventing the execution of any
64-bit binary.

With these changes, an error is printed and search_binary_handler()
continues on to the next handler, allowing the original executable to
run normally so the user can (hopefully) fix their misconfiguration more
easily.

Caveats:
- binfmt_misc is skipped as a whole. To allow for a more generic
  solution that works for any binfmt without a lot of duplicated code
  and added complexity, the error detection code is applied on the
  binfmt level.
- This is a fallback solution. It attempts to restore the state to allow
  executing most binaries without side effects, but it may not work for
  everything and should not be depended on for regular usage.

My (rough, but functional) test scripts for this issue are available at:
    https://gist.github.com/zml2008/6075418

Signed-off-by: Zach Levis <zach@zachsthings.com>
Signed-off-by: Zach Levis <zml@linux.vnet.ibm.com>
---
 fs/exec.c               |   27 +++++++++++++++++++++++++++
 include/linux/binfmts.h |    7 ++++++-
 2 files changed, 33 insertions(+), 1 deletions(-)

diff --git a/fs/exec.c b/fs/exec.c
index eb229e1..54c4929 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -1394,6 +1394,9 @@ int search_binary_handler(struct linux_binprm *bprm)
 		if (!try_module_get(fmt->module))
 			continue;
 		read_unlock(&binfmt_lock);
+		bprm->previous_binfmts[1] = bprm->previous_binfmts[0];
+		bprm->previous_binfmts[0] = fmt;
+
 		bprm->recursion_depth++;
 		retval = fmt->load_binary(bprm);
 		bprm->recursion_depth--;
@@ -1404,6 +1407,24 @@ int search_binary_handler(struct linux_binprm *bprm)
 		}
 		read_lock(&binfmt_lock);
 		put_binfmt(fmt);
+		if (retval == -ELOOP && bprm->recursion_depth == 0) { /* cur, previous */
+			pr_err("Too much recursion with binfmts (0:%s, -1:%s) in file %s, skipping (base %s).\n",
+					bprm->previous_binfmts[0]->name,
+					bprm->previous_binfmts[1]->name,
+					bprm->filename,
+					fmt->name);
+
+			/* Put argv back in its place */
+			bprm->p = bprm->p_no_argv;
+
+			bprm->argc = count(*(bprm->argv_orig), MAX_ARG_STRINGS);
+			retval = copy_strings(bprm->argc, *(bprm->argv_orig), bprm);
+			if (retval < 0)
+				return retval;
+
+			retval = -ENOEXEC;
+			continue;
+		}
 	}
 	read_unlock(&binfmt_lock);
 
@@ -1436,6 +1457,10 @@ static int exec_binprm(struct linux_binprm *bprm)
 	if (ret >= 0) {
 		trace_sched_process_exec(current, old_pid, bprm);
 		ptrace_event(PTRACE_EVENT_EXEC, old_vpid);
+		/* Successful execution, now null out the cached argv
+		 * (we don't want to access it later)
+		 * */
+		bprm->argv_orig = NULL;
 		current->did_exec = 1;
 		proc_exec_connector(current);
 
@@ -1533,9 +1558,11 @@ static int do_execve_common(const char *filename,
 	if (retval < 0)
 		goto out;
 
+	bprm->p_no_argv = bprm->p;
 	retval = copy_strings(bprm->argc, argv, bprm);
 	if (retval < 0)
 		goto out;
+	bprm->argv_orig = &argv;
 
 	retval = exec_binprm(bprm);
 	if (retval < 0)
diff --git a/include/linux/binfmts.h b/include/linux/binfmts.h
index 402a74a..42c1656 100644
--- a/include/linux/binfmts.h
+++ b/include/linux/binfmts.h
@@ -8,6 +8,8 @@
 
 #define CORENAME_MAX_SIZE 128
 
+struct user_arg_ptr; /* Struct from fs/exec.c, for linux_binprm->argv_orig */
+
 /*
  * This structure is used to hold the arguments that are used when loading binaries.
  */
@@ -21,7 +23,7 @@ struct linux_binprm {
 	struct page *page[MAX_ARG_PAGES];
 #endif
 	struct mm_struct *mm;
-	unsigned long p; /* current top of mem */
+	unsigned long p, p_no_argv; /* current top of mem */
 	unsigned int
 		cred_prepared:1,/* true if creds already prepared (multiple
 				 * preps happen for interpreters) */
@@ -32,11 +34,14 @@ struct linux_binprm {
 	unsigned int taso:1;
 #endif
 	unsigned int recursion_depth;
+	/* current binfmt at 0 and previous binfmt at 1 */
+	struct linux_binfmt *previous_binfmts[2];
 	struct file * file;
 	struct cred *cred;	/* new credentials */
 	int unsafe;		/* how unsafe this exec is (mask of LSM_UNSAFE_*) */
 	unsigned int per_clear;	/* bits to clear in current->personality */
 	int argc, envc;
+	struct user_arg_ptr *argv_orig;
 	const char * filename;	/* Name of binary as seen by procps */
 	const char * interp;	/* Name of the binary really executed. Most
 				   of the time same as filename, but could be
-- 
1.7.1

  parent reply	other threads:[~2013-08-02 22:12 UTC|newest]

Thread overview: 35+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2013-07-25 15:40 [PATCH 1/3] fs/binfmts: Add a name field to the binfmt struct Zach Levis
2013-07-25 15:40 ` [PATCH 2/3] fs/binfmts: Better handling of binfmt loops Zach Levis
2013-07-30 21:04   ` Andrew Morton
2013-07-30 23:16     ` Zach Levis
2013-07-30 23:26       ` Andrew Morton
2013-07-31 16:17         ` Zach Levis
2013-07-25 15:40 ` [PATCH 3/3] fs/binfmts: Whitespace fixes with scripts/cleanfile Zach Levis
2013-08-02 22:12 ` [PATCH v2 0/3] fs/binfmts: Improve handling of loops Zach Levis
2013-08-02 22:12 ` [PATCH v2 1/3] fs/binfmts: Add a name field to the binfmt struct Zach Levis
2013-08-02 22:12 ` Zach Levis [this message]
2013-08-02 22:49   ` [PATCH v2 2/3] fs/binfmts: Better handling of binfmt loops Zach Levis
2013-08-02 22:12 ` [PATCH v2 3/3] fs/binfmts: Whitespace fixes with scripts/cleanfile Zach Levis
2013-08-02 23:21 ` [PATCH v3 0/3] fs/binfmts: Improve handling of loops Zach Levis
2013-08-06 21:11   ` Kees Cook
2013-08-07 23:30     ` Zach Levis
2013-08-02 23:21 ` [PATCH v3 1/3] fs/binfmts: Add a name field to the binfmt struct Zach Levis
2013-08-03 16:41   ` Oleg Nesterov
2013-08-02 23:21 ` [PATCH v3 2/3] fs/binfmts: Better handling of binfmt loops Zach Levis
2013-08-03 16:42   ` Oleg Nesterov
2013-08-02 23:21 ` [PATCH v3 3/3] fs/binfmts: Whitespace fixes with scripts/cleanfile Zach Levis
2013-08-03 16:51   ` Oleg Nesterov
2013-08-14 16:31 ` [PATCH v4 0/3] fs/binfmts: Improve handling of loops Zach Levis
2013-08-14 16:31 ` [PATCH v4 1/3] fs/binfmts: Add a name field to the binfmt struct Zach Levis
2013-08-14 16:31 ` [PATCH v4 2/3] fs/binfmts: Better handling of binfmt loops Zach Levis
2013-08-14 17:50   ` Oleg Nesterov
2013-08-15 16:26     ` Zach L
2013-08-16 12:23       ` Oleg Nesterov
2013-08-14 18:16   ` Oleg Nesterov
2013-08-14 16:31 ` [PATCH v4 3/3] fs/binfmts: Whitespace fixes with scripts/cleanfile Zach Levis
2013-08-15 16:20 ` [PATCH v5 0/3] fs/binfmts: Improve handling of loops Zach Levis
2013-08-15 16:20 ` [PATCH v5 1/3] fs/binfmts: Add a name field to the binfmt struct Zach Levis
2013-08-15 17:06   ` Kees Cook
2013-08-15 16:20 ` [PATCH v5 2/3] fs/binfmts: Better handling of binfmt loops Zach Levis
2013-08-16 13:15   ` Oleg Nesterov
2013-08-15 16:20 ` [PATCH v5 3/3] fs/binfmts: Whitespace fixes with scripts/cleanfile Zach Levis

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=1375481535-20034-3-git-send-email-zml@linux.vnet.ibm.com \
    --to=zml@linux.vnet.ibm.com \
    --cc=akpm@linux-foundation.org \
    --cc=dan.carpenter@oracle.com \
    --cc=linux-fsdevel@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=oleg@redhat.com \
    --cc=viro@zeniv.linux.org.uk \
    --cc=zach@zachsthings.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).