ALT Linux Team development discussions
 help / color / mirror / Atom feed
From: "Anton V. Boyarshinov" <boyarsh@altlinux.org>
To: Alexey Sheplyakov <asheplyakov@basealt.ru>
Cc: nir@basealt.ru,
	ALT Linux Team development discussions <devel@lists.altlinux.org>,
	Alexey Sheplyakov <asheplyakov@altlinux.org>
Subject: Re: [devel] [PATCH] AltHa: avoid kernel stack overflow
Date: Mon, 17 Jan 2022 10:43:19 +0300
Message-ID: <20220117104319.28cc8638@t14.localdomain> (raw)
In-Reply-To: <20220114151823.239944-1-asheplyakov@basealt.ru>

В Fri, 14 Jan 2022 19:18:23 +0400
Alexey Sheplyakov <asheplyakov@basealt.ru> пишет:

> From: Alexey Sheplyakov <asheplyakov@altlinux.org>
 
Thank you! I've planned to do it, but too lazy.

 * The kernel stack on most architectures is 4096 bytes.
> * PATH_MAX is also 4096 (bytes).
> 
> Therefore
> 
> * Allocating PATH_MAX bytes on the stack definitely overflows
>   the (kernel) stack (perhaps this can be exploited by creating
>   a long enough path). To avoid the problem allocate `path_buffer`
>   on the heap (and free it on all code paths)
> 
> * CONFIG_FRAME_WARN=6144 (which is 1.5x the kernel stack size)
>   is wrong and dangerous (it papers over actual overflows and
>   creates a false sense of safety), use the default value instead
>   (2048 bytes, which is a half of the kernel stack)
> 
> Signed-off-by: Alexey Sheplyakov <asheplyakov@altlinux.org>
> ---
>  config                     |  2 +-
>  security/altha/altha_lsm.c | 21 ++++++++++++++++++---
>  2 files changed, 19 insertions(+), 4 deletions(-)
> 
> diff --git a/config b/config
> index da093b3f8e64..5ef328887321 100644
> --- a/config
> +++ b/config
> @@ -10347,7 +10347,7 @@ CONFIG_DEBUG_INFO_BTF=y
>  CONFIG_PAHOLE_HAS_SPLIT_BTF=y
>  CONFIG_DEBUG_INFO_BTF_MODULES=y
>  # CONFIG_GDB_SCRIPTS is not set
> -CONFIG_FRAME_WARN=6144
> +CONFIG_FRAME_WARN=2048
>  # CONFIG_STRIP_ASM_SYMS is not set
>  # CONFIG_READABLE_ASM is not set
>  # CONFIG_HEADERS_INSTALL is not set
> diff --git a/security/altha/altha_lsm.c b/security/altha/altha_lsm.c
> index ccde83ebb26c..c670ad7ed458 100644
> --- a/security/altha/altha_lsm.c
> +++ b/security/altha/altha_lsm.c
> @@ -243,8 +243,13 @@ static int altha_bprm_creds_from_file(struct linux_binprm *bprm, struct file * f
>  	struct altha_list_struct *node;
>  	/* when it's not a shebang issued script interpreter */
>  	if (rstrscript_enabled && bprm->executable == bprm->interpreter) {
> -		char path_buffer[PATH_MAX];
>  		char *path_p;
> +		char *path_buffer;
> +
> +		path_buffer = kmalloc(PATH_MAX, GFP_KERNEL);
> +		if (!path_buffer)
> +			return -ENOMEM;
> +
>  		path_p = d_path(&bprm->file->f_path,path_buffer,PATH_MAX);
>  		down_read(&interpreters_sem);
>  		list_for_each_entry(node, &interpreters_list, list) {
> @@ -255,16 +260,24 @@ static int altha_bprm_creds_from_file(struct linux_binprm *bprm, struct file * f
>  				    ("AltHa/RestrScript: %s is blocked to run directly by %d\n",
>  				     bprm->filename, cur_uid);
>  				up_read(&interpreters_sem);
> +				kfree(path_buffer);
>  				return -EPERM;
>  			}
>  		}
>  		up_read(&interpreters_sem);
> +		kfree(path_buffer);
>  	}
>  	if (unlikely(nosuid_enabled &&
>  		     !uid_eq(bprm->cred->uid, bprm->cred->euid))) {
> -		char path_buffer[PATH_MAX];
>  		char *path_p;
> -		uid_t cur_uid = from_kuid(bprm->cred->user_ns, bprm->cred->uid);
> +		char *path_buffer;
> +		uid_t cur_uid;
> +
> +		path_buffer = kmalloc(PATH_MAX, GFP_KERNEL);
> +		if (!path_buffer)
> +			return -ENOMEM;
> +
> +		cur_uid = from_kuid(bprm->cred->user_ns, bprm->cred->uid);
>  		path_p = d_path(&bprm->file->f_path,path_buffer,PATH_MAX);
>  		down_read(&nosuid_exceptions_sem);
>  		list_for_each_entry(node, &nosuid_exceptions_list, list) {
> @@ -273,6 +286,7 @@ static int altha_bprm_creds_from_file(struct linux_binprm *bprm, struct file * f
>  				    ("AltHa/NoSUID: %s permitted to setuid from %d\n",
>  				     bprm->filename, cur_uid);
>  				up_read(&nosuid_exceptions_sem);
> +				kfree(path_buffer);
>  				return 0;
>  			}
>  		}
> @@ -281,6 +295,7 @@ static int altha_bprm_creds_from_file(struct linux_binprm *bprm, struct file * f
>  		    ("AltHa/NoSUID: %s prevented to setuid from %d\n",
>  		     bprm->filename, cur_uid);
>  		bprm->cred->euid = bprm->cred->uid;
> +		kfree(path_buffer);
>  	}
>  	return 0;
>  }



      parent reply	other threads:[~2022-01-17  7:43 UTC|newest]

Thread overview: 3+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-01-14 15:18 Alexey Sheplyakov
2022-01-14 16:34 ` Vladimir D. Seleznev
2022-01-17  7:43 ` Anton V. Boyarshinov [this message]

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20220117104319.28cc8638@t14.localdomain \
    --to=boyarsh@altlinux.org \
    --cc=asheplyakov@altlinux.org \
    --cc=asheplyakov@basealt.ru \
    --cc=devel@lists.altlinux.org \
    --cc=nir@basealt.ru \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

ALT Linux Team development discussions

This inbox may be cloned and mirrored by anyone:

	git clone --mirror http://lore.altlinux.org/devel/0 devel/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 devel devel/ http://lore.altlinux.org/devel \
		devel@altlinux.org devel@altlinux.ru devel@lists.altlinux.org devel@lists.altlinux.ru devel@linux.iplabs.ru mandrake-russian@linuxteam.iplabs.ru sisyphus@linuxteam.iplabs.ru
	public-inbox-index devel

Example config snippet for mirrors.
Newsgroup available over NNTP:
	nntp://lore.altlinux.org/org.altlinux.lists.devel


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git