]> git.baikalelectronics.ru Git - kernel.git/commit
proc: Check /proc/$pid/attr/ writes against file opener
authorKees Cook <keescook@chromium.org>
Tue, 25 May 2021 19:37:35 +0000 (12:37 -0700)
committerLinus Torvalds <torvalds@linux-foundation.org>
Tue, 25 May 2021 20:24:41 +0000 (10:24 -1000)
commit24a21adb568239786b2a0a2117a054d2e4df8646
treed5327bdc0a2bb41db9968c7937810d40875b090a
parent2bf3dd8308680f052e713be25e6f6e6cb24b0e8e
proc: Check /proc/$pid/attr/ writes against file opener

Fix another "confused deputy" weakness[1]. Writes to /proc/$pid/attr/
files need to check the opener credentials, since these fds do not
transition state across execve(). Without this, it is possible to
trick another process (which may have different credentials) to write
to its own /proc/$pid/attr/ files, leading to unexpected and possibly
exploitable behaviors.

[1] https://www.kernel.org/doc/html/latest/security/credentials.html?highlight=confused#open-file-credentials

Fixes: 1da177e4c3f41 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
fs/proc/base.c