hollalinux
/
linux-sg2042
mirror of https://github.com/sophgo/linux-riscv.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6 

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6:
  CRED: Fix SUID exec regression
This commit is contained in:
Linus Torvalds 2009-02-06 18:52:55 -08:00
parent ae1a25da84 0bf2f3aec5
commit ccfef64621
3 changed files with 24 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
fs/compat.c
View File

@ -1407,7 +1407,7 @@ int compat_do_execve(char * filename,
bprm->cred = prepare_exec_creds(); bprm->cred = prepare_exec_creds();
if (!bprm->cred) if (!bprm->cred)
goto out_unlock; goto out_unlock;
check_unsafe_exec(bprm); check_unsafe_exec(bprm, current->files);
file = open_exec(filename); file = open_exec(filename);
retval = PTR_ERR(file); retval = PTR_ERR(file);

28
fs/exec.c
View File

@ -1049,16 +1049,32 @@ EXPORT_SYMBOL(install_exec_creds);
* - the caller must hold current->cred_exec_mutex to protect against * - the caller must hold current->cred_exec_mutex to protect against
* PTRACE_ATTACH * PTRACE_ATTACH
*/ */
void check_unsafe_exec(struct linux_binprm *bprm) void check_unsafe_exec(struct linux_binprm *bprm, struct files_struct *files)
{ {
struct task_struct *p = current; struct task_struct *p = current, *t;
unsigned long flags;
unsigned n_fs, n_files, n_sighand;
bprm->unsafe = tracehook_unsafe_exec(p); bprm->unsafe = tracehook_unsafe_exec(p);
if (atomic_read(&p->fs->count) > 1 || n_fs = 1;
atomic_read(&p->files->count) > 1 || n_files = 1;
atomic_read(&p->sighand->count) > 1) n_sighand = 1;
lock_task_sighand(p, &flags);
for (t = next_thread(p); t != p; t = next_thread(t)) {
if (t->fs == p->fs)
n_fs++;
if (t->files == files)
n_files++;
n_sighand++;
}
if (atomic_read(&p->fs->count) > n_fs ||
atomic_read(&p->files->count) > n_files ||
atomic_read(&p->sighand->count) > n_sighand)
bprm->unsafe |= LSM_UNSAFE_SHARE; bprm->unsafe |= LSM_UNSAFE_SHARE;
unlock_task_sighand(p, &flags);
} }
/* /*
@ -1273,7 +1289,7 @@ int do_execve(char * filename,
bprm->cred = prepare_exec_creds(); bprm->cred = prepare_exec_creds();
if (!bprm->cred) if (!bprm->cred)
goto out_unlock; goto out_unlock;
check_unsafe_exec(bprm); check_unsafe_exec(bprm, displaced);
file = open_exec(filename); file = open_exec(filename);
retval = PTR_ERR(file); retval = PTR_ERR(file);

2
fs/internal.h
View File

@ -43,7 +43,7 @@ extern void __init chrdev_init(void);
/* /*
* exec.c * exec.c
*/ */
extern void check_unsafe_exec(struct linux_binprm *); extern void check_unsafe_exec(struct linux_binprm *, struct files_struct *);
/* /*
* namespace.c * namespace.c