Jann Horn 378c6520e7 fs/coredump: prevent fsuid=0 dumps into user-controlled directories ... This commit fixes the following security hole affecting systems where all of the following conditions are fulfilled: - The fs.suid_dumpable sysctl is set to 2. - The kernel.core_pattern sysctl's value starts with "/". (Systems where kernel.core_pattern starts with "|/" are not affected.) - Unprivileged user namespace creation is permitted. (This is true on Linux >=3.8, but some distributions disallow it by default using a distro patch.) Under these conditions, if a program executes under secure exec rules, causing it to run with the SUID_DUMP_ROOT flag, then unshares its user namespace, changes its root directory and crashes, the coredump will be written using fsuid=0 and a path derived from kernel.core_pattern - but this path is interpreted relative to the root directory of the process, allowing the attacker to control where a coredump will be written with root privileges. To fix the security issue, always interpret core_pattern for dumps that are written under SUID_DUMP_ROOT relative to the root directory of init. Signed-off-by: Jann Horn <jann@thejh.net> Acked-by: Kees Cook <keescook@chromium.org> Cc: Al Viro <viro@zeniv.linux.org.uk> Cc: "Eric W. Biederman" <ebiederm@xmission.com> Cc: Andy Lutomirski <luto@kernel.org> Cc: Oleg Nesterov <oleg@redhat.com> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>		2016-03-22 15:36:02 -07:00
..
configs
drivers	fs/coredump: prevent fsuid=0 dumps into user-controlled directories	2016-03-22 15:36:02 -07:00
include	um, pkeys: Add UML arch_*_access_permitted() methods	2016-02-18 19:46:28 +01:00
kernel	mm: cleanup *pte_alloc* interfaces	2016-03-17 15:09:34 -07:00
os-Linux	um: Use race-free temporary file creation	2016-01-10 21:49:50 +01:00
scripts
.gitignore
Kconfig.char
Kconfig.common	um: Add seccomp support	2016-01-10 21:49:49 +01:00
Kconfig.debug
Kconfig.net
Kconfig.rest
Kconfig.um	um: Add seccomp support	2016-01-10 21:49:49 +01:00
Makefile	arch: um: fix error when linking vmlinux.	2015-12-08 22:25:13 +01:00
Makefile-os-Linux
Makefile-skas