From d4a9bb721dbd8c82677eeff984b496cea675993d Mon Sep 17 00:00:00 2001i
From: Davidlohr Bueso <dave@stgolabs.net>
Date: Thu, 1 Mar 2018 07:28:25 -0800
Subject: [PATCH 2/3] ipc/sem: introduce semctl(SEM_STAT_ANY)
Patch-mainline: v4.17-rc1
Git-commit: a280d6dc77eb6002f269d58cd47c7c7e69b617b6
References: bsc#1072689

There is a permission discrepancy when consulting sem ipc object metadata
between /proc/sysvipc/sem (0444) and the SEM_STAT semctl command.  The
later does permission checks for the object vs S_IRUGO.  As such there can
be cases where EACCESS is returned via syscall but the info is displayed
anyways in the procfs files.

While this might have security implications via info leaking (albeit no
writing to the sma metadata), this behavior goes way back and showing all
the objects regardless of the permissions was most likely an overlook - so
we are stuck with it.  Furthermore, modifying either the syscall or the
procfs file can cause userspace programs to break (ie ipcs).  Some
applications require getting the procfs info (without root privileges) and
can be rather slow in comparison with a syscall -- up to 500x in some
reported cases for shm.

This patch introduces a new SEM_STAT_ANY command such that the sem ipc
object permissions are ignored, and only audited instead.  In addition,
I've left the lsm security hook checks in place, as if some policy can
block the call, then the user has no other choice than just parsing the
procfs file.

Link: http://lkml.kernel.org/r/20180215162458.10059-3-dave@stgolabs.net
Signed-off-by: Davidlohr Bueso <dbueso@suse.de>
Reported-by: Robert Kettler <robert.kettler@outlook.com>
Cc: Eric W. Biederman <ebiederm@xmission.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Manfred Spraul <manfred@colorfullife.com>
Cc: Michael Kerrisk <mtk.manpages@gmail.com>
Cc: Michal Hocko <mhocko@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---
 include/uapi/linux/sem.h   |  2 ++
 ipc/compat.c               |  1 +
 ipc/sem.c                  | 15 +++++++++++----
 security/selinux/hooks.c   |  1 +
 security/smack/smack_lsm.c |  1 +
 5 files changed, 16 insertions(+), 4 deletions(-)

diff --git a/include/uapi/linux/sem.h b/include/uapi/linux/sem.h
index 67eb90361692..7c96eb5fa684 100644
--- a/include/uapi/linux/sem.h
+++ b/include/uapi/linux/sem.h
@@ -18,6 +18,8 @@
 /* ipcs ctl cmds */
 #define SEM_STAT 18
 #define SEM_INFO 19
+#define SEM_STAT_ANY 20
+
 
 /* Obsolete, used only for backwards compatibility and libc5 compiles */
 struct semid_ds {
diff --git a/ipc/compat.c b/ipc/compat.c
index 60fcce058dd8..7a261b13a34b 100644
--- a/ipc/compat.c
+++ b/ipc/compat.c
@@ -269,6 +269,7 @@ static long do_compat_semctl(int first, int second, int third, u32 pad)
 
 	case IPC_STAT:
 	case SEM_STAT:
+	case SEM_STAT_ANY:
 		up64 = compat_alloc_user_space(sizeof(sem64));
 		fourth = (unsigned long)up64;
 		err = sys_semctl(first, second, third, fourth);
diff --git a/ipc/sem.c b/ipc/sem.c
index d440ee85d7a5..ca9459b03dea 100644
--- a/ipc/sem.c
+++ b/ipc/sem.c
@@ -1217,6 +1217,7 @@ static int semctl_nolock(struct ipc_namespace *ns, int semid,
 	}
 	case IPC_STAT:
 	case SEM_STAT:
+	case SEM_STAT_ANY:
 	{
 		struct semid64_ds tbuf;
 		int id = 0;
@@ -1224,7 +1225,7 @@ static int semctl_nolock(struct ipc_namespace *ns, int semid,
 		memset(&tbuf, 0, sizeof(tbuf));
 
 		rcu_read_lock();
-		if (cmd == SEM_STAT) {
+		if (cmd == SEM_STAT || cmd == SEM_STAT_ANY) {
 			sma = sem_obtain_object(ns, semid);
 			if (IS_ERR(sma)) {
 				err = PTR_ERR(sma);
@@ -1239,9 +1240,14 @@ static int semctl_nolock(struct ipc_namespace *ns, int semid,
 			}
 		}
 
-		err = -EACCES;
-		if (ipcperms(ns, &sma->sem_perm, S_IRUGO))
-			goto out_unlock;
+		/* see comment for SHM_STAT_ANY */
+		if (cmd == SEM_STAT_ANY)
+			audit_ipc_obj(&sma->sem_perm);
+		else {
+			err = -EACCES;
+			if (ipcperms(ns, &sma->sem_perm, S_IRUGO))
+				goto out_unlock;
+		}
 
 		err = security_sem_semctl(sma, cmd);
 		if (err)
@@ -1601,6 +1607,7 @@ SYSCALL_DEFINE4(semctl, int, semid, int, semnum, int, cmd, unsigned long, arg)
 	case SEM_INFO:
 	case IPC_STAT:
 	case SEM_STAT:
+	case SEM_STAT_ANY:
 		return semctl_nolock(ns, semid, cmd, version, p);
 	case GETALL:
 	case GETVAL:
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 45f7b4dfecb4..fd3f5d055429 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -5787,6 +5787,7 @@ static int selinux_sem_semctl(struct sem_array *sma, int cmd)
 		break;
 	case IPC_STAT:
 	case SEM_STAT:
+	case SEM_STAT_ANY:
 		perms = SEM__GETATTR | SEM__ASSOCIATE;
 		break;
 	default:
diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
index e9933199213d..aa02976eaaa8 100644
--- a/security/smack/smack_lsm.c
+++ b/security/smack/smack_lsm.c
@@ -3194,6 +3194,7 @@ static int smack_sem_semctl(struct sem_array *sma, int cmd)
 	case GETALL:
 	case IPC_STAT:
 	case SEM_STAT:
+	case SEM_STAT_ANY:
 		may = MAY_READ;
 		break;
 	case SETVAL:
-- 
2.13.6