Jann Horn 378c6520e7 fs/coredump: prevent fsuid=0 dumps into user-controlled directories ... This commit fixes the following security hole affecting systems where all of the following conditions are fulfilled: - The fs.suid_dumpable sysctl is set to 2. - The kernel.core_pattern sysctl's value starts with "/". (Systems where kernel.core_pattern starts with "|/" are not affected.) - Unprivileged user namespace creation is permitted. (This is true on Linux >=3.8, but some distributions disallow it by default using a distro patch.) Under these conditions, if a program executes under secure exec rules, causing it to run with the SUID_DUMP_ROOT flag, then unshares its user namespace, changes its root directory and crashes, the coredump will be written using fsuid=0 and a path derived from kernel.core_pattern - but this path is interpreted relative to the root directory of the process, allowing the attacker to control where a coredump will be written with root privileges. To fix the security issue, always interpret core_pattern for dumps that are written under SUID_DUMP_ROOT relative to the root directory of init. Signed-off-by: Jann Horn <jann@thejh.net> Acked-by: Kees Cook <keescook@chromium.org> Cc: Al Viro <viro@zeniv.linux.org.uk> Cc: "Eric W. Biederman" <ebiederm@xmission.com> Cc: Andy Lutomirski <luto@kernel.org> Cc: Oleg Nesterov <oleg@redhat.com> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>		2016-03-22 15:36:02 -07:00
..
chan_kern.c
chan_user.c
chan_user.h
chan.h
cow_sys.h
cow_user.c
cow.h
daemon_kern.c
daemon_user.c
daemon.h
fd.c
harddog_kern.c
harddog_user.c
hostaudio_kern.c	[um] hostaudio: don't open-code memdup_user()	2016-01-04 10:29:40 -05:00
line.c
line.h
Makefile
mconsole_kern.c	fs/coredump: prevent fsuid=0 dumps into user-controlled directories	2016-03-22 15:36:02 -07:00
mconsole_kern.h
mconsole_user.c
mconsole.h
mmapper_kern.c
net_kern.c	um: net: replace GFP_KERNEL with GFP_ATOMIC when spinlock is held	2015-11-06 22:51:00 +01:00
net_user.c	um: fix returns without va_end	2015-12-08 22:26:00 +01:00
null.c
pcap_kern.c
pcap_user.c
pcap_user.h
port_kern.c
port_user.c
port.h
pty.c
random.c
slip_common.c
slip_common.h
slip_kern.c
slip_user.c
slip.h
slirp_kern.c
slirp_user.c
slirp.h
ssl.c
ssl.h
stderr_console.c
stdio_console.c
stdio_console.h
tty.c
ubd_kern.c	um: Update UBD to use pread/pwrite family of functions	2016-01-10 21:49:48 +01:00
ubd_user.c
ubd.h
umcast_kern.c
umcast_user.c
umcast.h
vde_kern.c
vde_user.c
vde.h
xterm_kern.c
xterm.c
xterm.h