linux-fsdevel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [PATCH RFC 0/4] coredump: mitigate privilege escalation of process coredump
@ 2021-12-27 22:34 Wander Lairson Costa
  2021-12-27 22:34 ` [PATCH RFC 1/4] exec: add a flag indicating if an exec file is a suid/sgid Wander Lairson Costa
                   ` (3 more replies)
  0 siblings, 4 replies; 5+ messages in thread
From: Wander Lairson Costa @ 2021-12-27 22:34 UTC (permalink / raw)
  To: Alexander Viro, Ingo Molnar, Peter Zijlstra, Juri Lelli,
	Vincent Guittot, Dietmar Eggemann, Steven Rostedt, Ben Segall,
	Mel Gorman, Daniel Bristot de Oliveira, Wander Lairson Costa,
	Laurent Vivier, YunQiang Su, Helge Deller, Eric W. Biederman,
	Alexey Gladkov, Andrew Morton, Jens Axboe, Rafael Aquini,
	Phil Auld, Rolf Eike Beer, Muchun Song,
	open list:FILESYSTEMS (VFS and infrastructure), open list

A set-uid executable might be a vector to privilege escalation if the
system configures the coredump file name pattern as a relative
directory destiny. The full description of the vulnerability and
a demonstration of how we can exploit it can be found at [1].

This patch series adds a PF_SUID flag to the process in execve if it is
set-[ug]id binary and elevates the new image's privileges.

In the do_coredump function, we check if:

1) We have the SUID_FLAG set
2) We have CAP_SYS_ADMIN (the process might have decreased its
   privileges)
3) The current directory is owned by root (the current code already
   checks for core_pattern being a relative path).
4) non-privileged users don't have permission to write to the current
   directory.

If all four conditions match, we set the need_suid_safe flag.

An alternative implementation (and more elegant IMO) would be saving
the fsuid and fsgid of the process in the task_struct before loading the
new image to the memory. But this approach would add eight bytes to all
task_struct instances where only a tiny fraction of the processes need
it and under a configuration that not all (most?) distributions don't
adopt by default.

Wander Lairson Costa (4):
  exec: add a flag indicating if an exec file is a suid/sgid
  process: add the PF_SUID flag
  coredump: mitigate privilege escalation of process coredump
  exec: only set the suid flag if the current proc isn't root

 fs/coredump.c           | 15 +++++++++++++++
 fs/exec.c               | 10 ++++++++++
 include/linux/binfmts.h |  6 +++++-
 include/linux/sched.h   |  1 +
 kernel/fork.c           |  2 ++
 5 files changed, 33 insertions(+), 1 deletion(-)

-- 
2.27.0


^ permalink raw reply	[flat|nested] 5+ messages in thread
end of thread, other threads:[~2021-12-27 22:38 UTC | newest]

Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2021-12-27 22:34 [PATCH RFC 0/4] coredump: mitigate privilege escalation of process coredump Wander Lairson Costa
2021-12-27 22:34 ` [PATCH RFC 1/4] exec: add a flag indicating if an exec file is a suid/sgid Wander Lairson Costa
2021-12-27 22:34 ` [PATCH RFC 2/4] process: add the PF_SUID flag Wander Lairson Costa
2021-12-27 22:34 ` [PATCH RFC 3/4] coredump: mitigate privilege escalation of process coredump Wander Lairson Costa
2021-12-27 22:34 ` [PATCH RFC 4/4] exec: only set the suid flag if the current proc isn't root Wander Lairson Costa

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).