From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755001AbbEULyG (ORCPT ); Thu, 21 May 2015 07:54:06 -0400 Received: from mailout3.w1.samsung.com ([210.118.77.13]:16069 "EHLO mailout3.w1.samsung.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752457AbbEULx6 (ORCPT ); Thu, 21 May 2015 07:53:58 -0400 X-AuditID: cbfec7f4-f79c56d0000012ee-8f-555dc75298c2 From: Lukasz Pawelczyk To: "David S. Miller" , "Eric W. Biederman" , "Kirill A. Shutemov" , "Serge E. Hallyn" , Al Viro , Alexey Dobriyan , Andrew Morton , Andy Lutomirski , Casey Schaufler , Christoph Hellwig , David Howells , Eric Dumazet , Fabian Frederick , Greg KH , Ingo Molnar , Ionut Alexa , James Morris , Jeff Layton , Joe Perches , Jonathan Corbet , Kees Cook , Lukasz Pawelczyk , Mauro Carvalho Chehab , Michal Hocko , Miklos Szeredi , Nick Kralevich , Oleg Nesterov , Paul Moore , Peter Hurley , Peter Zijlstra , Rik van Riel , Serge Hallyn , Stephen Smalley , Tejun Heo , Zefan Li , Rafal Krypa , linux-doc@vger.kernel.org, linux-api@vger.kernel.org, linux-kernel@vger.kernel.org, linux-security-module@vger.kernel.org, containers@lists.linux-foundation.org Cc: Lukasz Pawelczyk Subject: [PATCH 1/8] kernel/exit.c: make sure current's nsproxy != NULL while checking caps Date: Thu, 21 May 2015 13:53:35 +0200 Message-id: <1432209222-8479-2-git-send-email-l.pawelczyk@samsung.com> X-Mailer: git-send-email 2.1.0 In-reply-to: <1432209222-8479-1-git-send-email-l.pawelczyk@samsung.com> References: <1432209222-8479-1-git-send-email-l.pawelczyk@samsung.com> X-Brightmail-Tracker: H4sIAAAAAAAAAzWSa0hTcRjG/e+cnTOtwcFWnjSsBiFJmULBS4b0JT1FpJgVJVZLjxdy0zYV zS+bl7KVZtPwXsoyL1tMLS1dXtJ0eclLihfwEl5mVkvDYHlPJ3378fyel+fLy8NsF3F7Xpgk ipVKROFCwgbvXDcMHL1oCLjkOvcegyzFOcjXaQkYr1kmQPtyjoDppvsI8nuScPiVsILDRk0S CTNtkyQoV5YISFTrCNj4cQTKNK0c6Mip5ELalC9o/04gyJuYwqHroRi0T4ow6FIVceC1OYWA onsvcOivyydg4dEkAaqUVBI0r+Rc0Bhj4XuimQtGfSUGmvUOBGOZzzGobkxG0PZlHYEhtYkD i4PLJJhUpRisDehwaNGrMehWzOLQ09tNwnJJK4KeNQP3tDMz8XMNZ3LlqQSTJ+/DmTdlIxym NneMZAqroplB/VUm6aOJy5Su6gjmdakzU1X+gGA+Za/gTGOBlmQyhksQox+RE4w6LYPrs/+a zakgNjwshpUe87hpE9o9VUlGPnOIfV4/RMhRpp0SWfNo6jitnB1D27yH7h3XEVtsSxUjWvdB pkQ2m6zg0FmrUxZBUK60ubce2xICSrWTfjxdbbnGKCe6OC8R3+JdVACtyFRacpw6RNcYNZac T3nSLZUqbHvNka7Qb1g61pQX/Wy4ndxe9qSXjGpuOuIXIqtytJuNDoyU3QoRu7nIRGJZtCTE JTBCXIW2X+HPO6RuO9mMKB4S7uTznAIu2XJFMbI4cTOieZhQwL/QsBnxg0Rxd1lpxA1pdDgr a0YOPFxoxy+om/ezpUJEUextlo1kpf8th2dtL0cVa+s1b49kj/5OyfMOzlQvds71u6U70qFu HdnmREGgleN110aTOP5ErHLgzosV8+i8+wGfBFPr0yzJ3sOPv/H9y87nhH42ngmOZ5NqJb4G LwF/xxXPwnlJnKlv1XvGI7n5snv2aPvZjpmmhgFfreKguO3D0L6Cr4I0zD95YdbvmBCXhYrc nDGpTPQPsKFzegYDAAA= Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org There is a rare case where current's nsproxy might be NULL but we are required to check for credentials and capabilities. It sometimes happens during an exit_group() syscall while destroying user's session (logging out). My understanding is that while we have to lock the task to get task's nsproxy and check whether it's NULL, for the 'current' we don't have to and it's expected not to be NULL. There is a code in the kernel currently that does current->nsproxy->user_ns without any checks. And include/linux/nsproxy.h confirms that: 2. when accessing (i.e. reading) current task's namespaces - no precautions should be taken - just dereference the pointers There seem to be no crash currently because of this, but with accessing nsproxy from LSM hooks there is. This is the backtrace: 0 smk_tskacc (task=0xffff88003b0b92e0, obj_known=0x2 , mode=2, a=0xffff88003be53dd8) at security/smack/smack_access.c:261 1 0xffffffff8130e2aa in smk_curacc (obj_known=, mode=, a=) at security/smack/smack_access.c:318 2 0xffffffff8130a50d in smack_task_kill (p=0xffff88003b0b92e0, info=, sig=, secid=) at security/smack/smack_lsm.c:2071 3 0xffffffff812ea4f6 in security_task_kill (p=, info=, sig=, secid=) at security/security.c:952 4 0xffffffff8109ac80 in check_kill_permission (sig=15, info=0x0 , t=0xffff88003b0b8000) at kernel/signal.c:796 5 0xffffffff8109d3ab in group_send_sig_info (sig=15, info=0x0 , p=0xffff88003b0b8000) at kernel/signal.c:1296 6 0xffffffff8108e527 in forget_original_parent (father=) at kernel/exit.c:575 7 exit_notify (group_dead=, tsk=) at kernel/exit.c:606 8 do_exit (code=) at kernel/exit.c:775 9 0xffffffff8108ec0f in do_group_exit (exit_code=0) at kernel/exit.c:891 10 0xffffffff8108ec84 in SYSC_exit_group (error_code=) at kernel/exit.c:902 11 SyS_exit_group (error_code=) at kernel/exit.c:900 This backtrace clearly shows that there is an LSM hook task_kill() that happens during an exit_group() syscall and that this happens after exit_task_namespaces(). LSM hooks with namespaces might need nsproxy to be able to check for capabilities. At this point this is impossible. The current's nsproxy is already NULL/destroyed. This is the case because exit_task_namespaces() is called before the exit_notify() where all of the above happens. This patch changes their order. Signed-off-by: Lukasz Pawelczyk --- kernel/exit.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/kernel/exit.c b/kernel/exit.c index 22fcc05..da1bb18 100644 --- a/kernel/exit.c +++ b/kernel/exit.c @@ -742,7 +742,6 @@ void do_exit(long code) exit_fs(tsk); if (group_dead) disassociate_ctty(1); - exit_task_namespaces(tsk); exit_task_work(tsk); exit_thread(); @@ -763,6 +762,13 @@ void do_exit(long code) TASKS_RCU(tasks_rcu_i = __srcu_read_lock(&tasks_rcu_exit_srcu)); exit_notify(tsk, group_dead); + + /* + * This should be after all things that potentially require + * process's namespaces (e.g. capability checks). + */ + exit_task_namespaces(tsk); + proc_exit_connector(tsk); #ifdef CONFIG_NUMA task_lock(tsk); -- 2.1.0