From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753073AbbK2OJJ (ORCPT ); Sun, 29 Nov 2015 09:09:09 -0500 Received: from 1.mo6.mail-out.ovh.net ([46.105.56.136]:35899 "EHLO 1.mo6.mail-out.ovh.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752787AbbK2OJH (ORCPT ); Sun, 29 Nov 2015 09:09:07 -0500 From: =?UTF-8?q?Micka=C3=ABl=20Sala=C3=BCn?= To: linux-kernel@vger.kernel.org Cc: =?UTF-8?q?Micka=C3=ABl=20Sala=C3=BCn?= , Jeff Dike , Richard Weinberger , Tristan Schmelcher , Greg Kroah-Hartman , user-mode-linux-devel@lists.sourceforge.net, user-mode-linux-user@lists.sourceforge.net Subject: [PATCH v2 1/2] um: Set secure access mode for temporary file Date: Sun, 29 Nov 2015 15:03:21 +0100 Message-Id: <1448805802-12156-2-git-send-email-mic@digikod.net> X-Mailer: git-send-email 2.6.2 In-Reply-To: <1448805802-12156-1-git-send-email-mic@digikod.net> References: <1448805802-12156-1-git-send-email-mic@digikod.net> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Ovh-Tracer-Id: 411234941560334617 X-Ovh-Remote: 94.23.54.103 (ns3096276.ip-94-23-54.eu) X-Ovh-Local: 213.186.33.20 (ns0.ovh.net) X-OVH-SPAMSTATE: OK X-OVH-SPAMSCORE: -100 X-OVH-SPAMCAUSE: gggruggvucftvghtrhhoucdtuddrfeekhedrkeeiucetufdoteggodftvfcurfhrohhfihhlvgemucfqggfjnecuuegrihhlohhuthemuceftddtnecusecvtfgvtghiphhivghnthhsucdlqddutddtmd X-VR-SPAMSTATE: OK X-VR-SPAMSCORE: -100 X-VR-SPAMCAUSE: gggruggvucftvghtrhhoucdtuddrfeekhedrkeeiucetufdoteggodftvfcurfhrohhfihhlvgemucfqggfjnecuuegrihhlohhuthemuceftddtnecusecvtfgvtghiphhivghnthhsucdlqddutddtmd Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Replace the insecure mode 0777 with 0700 for temporary file to prohibit other users to change the executable mapped code. An attacker could gain access to the mapped file descriptor from the temporary file (before it is unlinked) in a read-only mode but it should not be accessible in write mode to avoid arbitrary code execution. Signed-off-by: Mickaël Salaün --- arch/um/os-Linux/mem.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/um/os-Linux/mem.c b/arch/um/os-Linux/mem.c index 897e9ad..798aeb4 100644 --- a/arch/um/os-Linux/mem.c +++ b/arch/um/os-Linux/mem.c @@ -142,7 +142,7 @@ static int __init create_tmp_file(unsigned long long len) if (fd < 0) exit(1); - err = fchmod(fd, 0777); + err = fchmod(fd, 0700); if (err < 0) { perror("fchmod"); exit(1); -- 2.6.2