Security bugfix for RSBAC for kernels 2.6.35 and later
Amon Ott <[email protected]>
| Newsgroups | gmane.linux.rsbac |
|---|---|
| Message-ID | <[email protected]> |
Hello everyone, unfortunately, there is a severe bug in the code that determines the RSBAC request type in sys_open() calls. As a result from this bug, open access will be decided upon by RSBAC with wrong request type, a read open can happen unnoticed. A read() access after opening is intercepted as intended, because only the open interception is wrong. Affected are all RSBAC git repos for kernels starting from 2.6.35 and the official release 1.4.5 for 2.6.35. RSBAC for kernel 2.6.32 is not affected. Please update your kernel sources from git or apply the attached patch for 2.6.35.y and rebuild to get the bug fixed. I will try to get a new release out for kernel 3.1.4 or later as soon as possible. After fixing, your system might need RSBAC rights adjustments, because the set of accesses changes. Background: Between 2.6.32 and 2.6.35, the meaning of the flags parameter for sys_open() helper functions changed from some translated internal value to an exact copy of the sys_open() flags parameter. When porting RSBAC code from 2.6.32, we did not notice that change. Amon. -- http://www.rsbac.org - GnuPG: 2048g/5DEAAA30 2002-10-22 _______________________________________________ rsbac mailing list [email protected] http://www.rsbac.org/mailman/listinfo/rsbac
openmode.diff
(text/x-diff, 1.4 KB)
commit eb08151b8d0916678d3a59d84d0c969279b601b8 Author: Amon Ott <[email protected]> Date: Wed Nov 30 09:18:12 2011 +0100 Fix open mode detection. diff --git a/fs/namei.c b/fs/namei.c index 3a6e1d8..99bb3c0 100644 --- a/fs/namei.c +++ b/fs/namei.c @@ -1891,18 +1891,16 @@ static struct file *finish_open(struct nameidata *nd, if (open_flag & O_APPEND) rsbac_adf_req = R_APPEND_OPEN; else - if ((open_flag & FMODE_WRITE) && (open_flag & FMODE_READ)) + if ((open_flag & O_RDWR) || ((open_flag & O_WRONLY) && (open_flag & O_RDONLY))) rsbac_adf_req = R_READ_WRITE_OPEN; else - if (open_flag & FMODE_WRITE) + if (open_flag & O_WRONLY) rsbac_adf_req = R_WRITE_OPEN; else - if (open_flag & FMODE_READ) { - if (rsbac_target == T_DIR) - rsbac_adf_req = R_READ; - else - rsbac_adf_req = R_READ_OPEN; - } + if (rsbac_target == T_DIR) + rsbac_adf_req = R_READ; + else + rsbac_adf_req = R_READ_OPEN; if ((rsbac_adf_req != R_NONE) && (rsbac_target != T_NONE)) { rsbac_attribute_value.open_flag = open_flag; if (!rsbac_adf_request(rsbac_adf_req, @@ -1944,7 +1942,7 @@ static struct file *finish_open(struct nameidata *nd, } #ifdef CONFIG_RSBAC - if ((rsbac_adf_req != R_NONE) && (rsbac_target != T_NONE)) { + if (!PTR_ERR(filp) && (rsbac_adf_req != R_NONE) && (rsbac_target != T_NONE)) { rsbac_new_target_id.dummy = 0; if (rsbac_adf_set_attr(rsbac_adf_req, task_pid(current),