rsbac proc checks

Amon is this for closing a door by a posible
_bad_child_with_root_rights_that_writes_in_bofh_memory through
/proc/$pid/mem?

Is denied by default?

:-S



Add missing interception to mem_read() and fix it in mem_write().



authorAmon Ott <[email protected]>
 Fri, 27 Jan 2012 15:02:29 +0000 (16:02 +0100)
committerAmon Ott <[email protected]>
 Fri, 2 Mar 2012 06:43:59 +0000 (07:43 +0100)






fs/proc/base.c

patch | blob | history






diff --git a/fs/proc/base.c b/fs/proc/base.c

index dd2c12c..804fe63 100644 (file)


--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -1007,14 +1007,12 @@ static ssize_t mem_rw(struct file *file, char
__user *buf,
                        size_t count, loff_t *ppos, int write)
 {
        struct mm_struct *mm = file->private_data;
-       unsigned long addr = *ppos;
-       ssize_t copied;
-       char *page;

 #ifdef CONFIG_RSBAC
+       enum  rsbac_adf_request_t rsbac_adf_req = R_NONE;
        union rsbac_target_id_t rsbac_target_id;
        union rsbac_attribute_value_t rsbac_attribute_value;
-       struct task_struct *rsbac_task =
get_proc_task(file->f_path.dentry->d_inode);
+       struct task_struct *rsbac_task;
 #endif

        if (!mm)
@@ -1022,16 +1020,25 @@ static ssize_t mem_rw(struct file *file, char
__user *buf,

 #ifdef CONFIG_RSBAC
        rsbac_pr_debug(aef, "calling ADF\n");
+       rsbac_task = get_proc_task(file->f_path.dentry->d_inode);
+       if (!rsbac_task)
+               return -ESRCH;
+        if (write)
+                rsbac_adf_req = R_MODIFY_SYSTEM_DATA;
+        else
+                rsbac_adf_req = R_GET_STATUS_DATA;
        rsbac_target_id.process = task_pid(rsbac_task);
        rsbac_attribute_value.dummy = 0;
-       if (!rsbac_adf_request(R_MODIFY_SYSTEM_DATA,
+       if (!rsbac_adf_request(rsbac_adf_req,
                                task_pid(current),
                                T_PROCESS,
                                rsbac_target_id,
                                A_none,
                                rsbac_attribute_value)) {
+                put_task_struct(rsbac_task);
                return -EPERM;
        }
+       put_task_struct(rsbac_task);
 #endif

        page = (char *)__get_free_page(GFP_TEMPORARY);