[PATCH] timekeeping: Require permission to set auxiliary clocks

[PATCH] timekeeping: Require permission to set auxiliary clocks

[Daehyeon Ko]

The generic clock_settime() entry point delegates permission checks to
each clock-specific callback. aux_clock_set() does not perform one. Once
an administrator enables an auxiliary clock, any local process can
therefore change the global clock offset.

A test process running as UID and GID 65534 with no effective, permitted,
inheritable, or ambient capabilities set CLOCK_AUX0 successfully, and a
separate process observed the new value. The same process was denied by
clock_adjtime(). An AppArmor profile denying sys_time also blocked
CLOCK_REALTIME changes but did not see the auxiliary clock operation.

Call security_settime64() before mutating the auxiliary timekeeper. This
matches CLOCK_REALTIME's permission model, enforces initial-user-namespace
CAP_SYS_TIME, and gives LSMs the settime hook while preserving authorized
clock changes.

Fixes: 60ecc26ec5af ("timekeeping: Provide time setter for auxiliary clocks")
Cc: stable@vger.kernel.org
Signed-off-by: Daehyeon Ko <4ncienth@gmail.com>
---
AI assistance was used for source analysis, reproducer development, and
validation. The submitter reviewed the resulting change before signing it.

 kernel/time/timekeeping.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
index ea2e6e55f37bf..1b342825bd8f1 100644
--- a/kernel/time/timekeeping.c
+++ b/kernel/time/timekeeping.c
@@ -14,6 +14,7 @@
 #include <linux/random.h>
 #include <linux/sched/clock.h>
 #include <linux/sched/loadavg.h>
+#include <linux/security.h>
 #include <linux/static_key.h>
 #include <linux/stop_machine.h>
 #include <linux/syscore_ops.h>
@@ -3215,11 +3216,15 @@ static int aux_clock_set(const clockid_t id, const struct timespec64 *tnew)
 	struct tk_data *aux_tkd = aux_get_tk_data(id);
 	struct timekeeper *aux_tks;
 	ktime_t tnow, nsecs;
+	int ret;
 
 	if (!timespec64_valid_settod(tnew))
 		return -EINVAL;
 	if (!aux_tkd)
 		return -ENODEV;
+	ret = security_settime64(tnew, NULL);
+	if (ret)
+		return ret;
 
 	aux_tks = &aux_tkd->shadow_timekeeper;
 

base-commit: c03c1a14507dfaf8b856c2608f9ac216021fc222
-- 
2.55.0

Re: [PATCH] timekeeping: Require permission to set auxiliary clocks

[shaos]

I tested this patch on x86_64 using QEMU TCG, with the reproduction
configuration and PoC from my report. The patch applied cleanly to
c03c1a14507dfaf8b856c2608f9ac216021fc222, and the kernel built and
booted successfully.

With the patch applied, an unprivileged process (uid 65534, with
CapEff=0) receives EPERM when calling clock_settime(CLOCK_AUX0) after
the clock has been enabled. An additional privileged control call
successfully set CLOCK_AUX0. The CLOCK_REALTIME settime and
CLOCK_AUX0 adjtime controls returned EPERM as expected.

For completeness, setting the disabled CLOCK_AUX1 as an unprivileged
caller also returned EPERM; the permission check runs before the
enabled-clock check.

Tested-by: shaos <shawnq1@163.com>