]> git.baikalelectronics.ru Git - kernel.git/commit
proc: Check /proc/$pid/attr/ writes against file opener
authorKees Cook <keescook@chromium.org>
Tue, 25 May 2021 19:37:35 +0000 (12:37 -0700)
committerLinus Torvalds <torvalds@linux-foundation.org>
Tue, 25 May 2021 20:24:41 +0000 (10:24 -1000)
commit4e0194280a768016ad31abe6aec7f08d683f2182
treed5327bdc0a2bb41db9968c7937810d40875b090a
parent15799ba1838441b9a67563c3a7922bc0219821b1
proc: Check /proc/$pid/attr/ writes against file opener

Fix another "confused deputy" weakness[1]. Writes to /proc/$pid/attr/
files need to check the opener credentials, since these fds do not
transition state across execve(). Without this, it is possible to
trick another process (which may have different credentials) to write
to its own /proc/$pid/attr/ files, leading to unexpected and possibly
exploitable behaviors.

[1] https://www.kernel.org/doc/html/latest/security/credentials.html?highlight=confused#open-file-credentials

Fixes: 1da177e4c3f41 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
fs/proc/base.c