From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id EFDD63F210C; Thu, 2 Apr 2026 17:47:13 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775152034; cv=none; b=CR9802IGt+rncmY7CsptPEn9YCCEOjAkpXXPcIdyOyUiF/J5QGxhRjEyHQGhHjsyborvtM7fC9WP2pC6T9/JEygfrcEZ4udLzSWS40CWk/O6N1JLVvRbazNWI/H1wXG8phmlHdSGVjJ7Cppb/i4hMo1h0LPDdX/KJ3wkUG3+9cQ= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775152034; c=relaxed/simple; bh=bvjP3KqeOQ0m0cE19vK2rRQuvmX1upwyF4DekI2dCuo=; h=Date:From:To:Cc:Subject:Message-Id:In-Reply-To:References: Mime-Version:Content-Type; b=gmXXU+mVUrUexw+YSAmvKlIa0doC2p4Q8fuRhO0hsCjcxsJVFTNJHRAMbNupGnDFPLy1l+TUEWkEcpybWmwsFteAw8HSfcPK24n66WNn77fSSn1cEQGSCruV3PdCDL4WdxwvaIcwBf5kwBjyrnaNPPU/Raq1w++Ian90NBLZQnw= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux-foundation.org header.i=@linux-foundation.org header.b=wMk9Ltsu; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux-foundation.org header.i=@linux-foundation.org header.b="wMk9Ltsu" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5E778C116C6; Thu, 2 Apr 2026 17:47:13 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linux-foundation.org; s=korg; t=1775152033; bh=bvjP3KqeOQ0m0cE19vK2rRQuvmX1upwyF4DekI2dCuo=; h=Date:From:To:Cc:Subject:In-Reply-To:References:From; b=wMk9LtsuEagrwVqNDqWTVTZcARYkL9PcUn+YxTHXTE4c0MDmwiFm8nVIGOBMFvIp7 7Hz6TU4T922Bi0RjkdHP2rkqXNdlJyNiG2uJvx/RujgFUrgJ8uniukuk9O4Z0Pc4CU zrE9rboFz4Nag1QkCr6wLEfS4krRTNpjtBYrPiKE= Date: Thu, 2 Apr 2026 10:47:12 -0700 From: Andrew Morton To: Qi Tang Cc: Cyrill Gorcunov , David Hildenbrand , Lorenzo Stoakes , Oleg Nesterov , linux-kernel@vger.kernel.org, stable@vger.kernel.org Subject: Re: [PATCH] prctl: require checkpoint_restore_ns_capable for PR_SET_MM_MAP Message-Id: <20260402104712.111d87b0154260372595cadf@linux-foundation.org> In-Reply-To: <20260402111332.55957-1-tpluszz77@gmail.com> References: <20260402111332.55957-1-tpluszz77@gmail.com> X-Mailer: Sylpheed 3.8.0beta1 (GTK+ 2.24.33; x86_64-pc-linux-gnu) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit On Thu, 2 Apr 2026 19:13:32 +0800 Qi Tang wrote: > prctl_set_mm_map() allows modifying all mm_struct boundaries and > the saved auxv vector. The individual field path (PR_SET_MM_START_CODE > etc.) correctly requires CAP_SYS_RESOURCE, but the PR_SET_MM_MAP path > dispatches before this check and has no capability requirement of its > own when exe_fd is -1. > > This means any unprivileged user on a CONFIG_CHECKPOINT_RESTORE kernel > (nearly all distros) can rewrite mm boundaries including start_brk, brk, > arg_start/end, env_start/end and saved_auxv. Consequences include: > > - SELinux PROCESS__EXECHEAP bypass via start_brk manipulation > - procfs info disclosure by pointing arg/env ranges at other memory > - auxv poisoning (AT_SYSINFO_EHDR, AT_BASE, AT_ENTRY) > > The original commit f606b77f1a9e ("prctl: PR_SET_MM -- introduce > PR_SET_MM_MAP operation") states "we require the caller to be at least > user-namespace root user", but this was never enforced in the code. > > Add a checkpoint_restore_ns_capable() check at the top of > prctl_set_mm_map(), after the PR_SET_MM_MAP_SIZE early return. This > requires CAP_CHECKPOINT_RESTORE or CAP_SYS_ADMIN in the caller's > user namespace, matching the stated design intent and the existing > check for exe_fd changes. Thanks. AI review claims to have found a couple of things: https://sashiko.dev/#/patchset/20260402111332.55957-1-tpluszz77@gmail.com