From 66c7c4bfcad138851ff072021cd03d26c6f5c865 Mon Sep 17 00:00:00 2001i
From: Davidlohr Bueso <dave@stgolabs.net>
Date: Thu, 1 Mar 2018 07:28:25 -0800
Subject: [PATCH 2/3] ipc/msg: introduce msgctl(MSG_STAT_ANY)
Patch-mainline: v4.17-rc1
Git-commit: 23c8cec8cf679b10997a512abb1e86f0cedc42ba
References: bsc#1072689
There is a permission discrepancy when consulting msq ipc object metadata
between /proc/sysvipc/msg (0444) and the MSG_STAT shmctl command. The
later does permission checks for the object vs S_IRUGO. As such there can
be cases where EACCESS is returned via syscall but the info is displayed
anyways in the procfs files.
While this might have security implications via info leaking (albeit no
writing to the msq metadata), this behavior goes way back and showing all
the objects regardless of the permissions was most likely an overlook - so
we are stuck with it. Furthermore, modifying either the syscall or the
procfs file can cause userspace programs to break (ie ipcs). Some
applications require getting the procfs info (without root privileges) and
can be rather slow in comparison with a syscall -- up to 500x in some
reported cases for shm.
This patch introduces a new MSG_STAT_ANY command such that the msq ipc
object permissions are ignored, and only audited instead. In addition,
I've left the lsm security hook checks in place, as if some policy can
block the call, then the user has no other choice than just parsing the
procfs file.
Link: http://lkml.kernel.org/r/20180215162458.10059-4-dave@stgolabs.net
Signed-off-by: Davidlohr Bueso <dbueso@suse.de>
Reported-by: Robert Kettler <robert.kettler@outlook.com>
Cc: Eric W. Biederman <ebiederm@xmission.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Manfred Spraul <manfred@colorfullife.com>
Cc: Michael Kerrisk <mtk.manpages@gmail.com>
Cc: Michal Hocko <mhocko@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---
include/uapi/linux/msg.h | 1 +
ipc/compat.c | 1 +
ipc/msg.c | 17 ++++++++++++-----
security/selinux/hooks.c | 1 +
security/smack/smack_lsm.c | 1 +
5 files changed, 16 insertions(+), 5 deletions(-)
diff --git a/include/uapi/linux/msg.h b/include/uapi/linux/msg.h
index f51c8001dbe5..25549e853000 100644
--- a/include/uapi/linux/msg.h
+++ b/include/uapi/linux/msg.h
@@ -6,6 +6,7 @@
/* ipcs ctl commands */
#define MSG_STAT 11
#define MSG_INFO 12
+#define MSG_STAT_ANY 13
/* msgrcv options */
#define MSG_NOERROR 010000 /* no error if message is too big */
diff --git a/ipc/compat.c b/ipc/compat.c
index 7a261b13a34b..55ce81f405f1 100644
--- a/ipc/compat.c
+++ b/ipc/compat.c
@@ -529,6 +529,7 @@ COMPAT_SYSCALL_DEFINE3(msgctl, int, first, int, second, void __user *, uptr)
case IPC_STAT:
case MSG_STAT:
+ case MSG_STAT_ANY:
p = compat_alloc_user_space(sizeof(m64));
err = sys_msgctl(first, second, p);
if (err < 0)
diff --git a/ipc/msg.c b/ipc/msg.c
index 2c38f10d1483..c44c4b416b40 100644
--- a/ipc/msg.c
+++ b/ipc/msg.c
@@ -491,6 +491,7 @@ static int msgctl_nolock(struct ipc_namespace *ns, int msqid,
}
case MSG_STAT:
+ case MSG_STAT_ANY:
case IPC_STAT:
{
struct msqid64_ds tbuf;
@@ -502,14 +503,14 @@ static int msgctl_nolock(struct ipc_namespace *ns, int msqid,
memset(&tbuf, 0, sizeof(tbuf));
rcu_read_lock();
- if (cmd == MSG_STAT) {
+ if (cmd == MSG_STAT || cmd == MSG_STAT_ANY) {
msq = msq_obtain_object(ns, msqid);
if (IS_ERR(msq)) {
err = PTR_ERR(msq);
goto out_unlock;
}
success_return = msq->q_perm.id;
- } else {
+ } else { /* IPC_STAT */
msq = msq_obtain_object_check(ns, msqid);
if (IS_ERR(msq)) {
err = PTR_ERR(msq);
@@ -518,9 +519,14 @@ static int msgctl_nolock(struct ipc_namespace *ns, int msqid,
success_return = 0;
}
- err = -EACCES;
- if (ipcperms(ns, &msq->q_perm, S_IRUGO))
- goto out_unlock;
+ /* see comment for SHM_STAT_ANY */
+ if (cmd == MSG_STAT_ANY)
+ audit_ipc_obj(&msq->q_perm);
+ else {
+ err = -EACCES;
+ if (ipcperms(ns, &msq->q_perm, S_IRUGO))
+ goto out_unlock;
+ }
err = security_msg_queue_msgctl(msq, cmd);
if (err)
@@ -567,6 +573,7 @@ SYSCALL_DEFINE3(msgctl, int, msqid, int, cmd, struct msqid_ds __user *, buf)
case IPC_INFO:
case MSG_INFO:
case MSG_STAT: /* msqid is an index rather than a msg queue id */
+ case MSG_STAT_ANY:
case IPC_STAT:
return msgctl_nolock(ns, msqid, cmd, version, buf);
case IPC_SET:
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index fd3f5d055429..be72774d8b2c 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -5531,6 +5531,7 @@ static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
case IPC_STAT:
case MSG_STAT:
+ case MSG_STAT_ANY:
perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
break;
case IPC_SET:
diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
index aa02976eaaa8..2aa0157afda1 100644
--- a/security/smack/smack_lsm.c
+++ b/security/smack/smack_lsm.c
@@ -3323,6 +3323,7 @@ static int smack_msg_queue_msgctl(struct msg_queue *msq, int cmd)
switch (cmd) {
case IPC_STAT:
case MSG_STAT:
+ case MSG_STAT_ANY:
may = MAY_READ;
break;
case IPC_SET:
--
2.13.6