From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id CA8E3C48291 for ; Fri, 2 Feb 2024 18:41:50 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 669926B0082; Fri, 2 Feb 2024 13:41:50 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id 61A196B0083; Fri, 2 Feb 2024 13:41:50 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 4E25D6B0085; Fri, 2 Feb 2024 13:41:50 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0016.hostedemail.com [216.40.44.16]) by kanga.kvack.org (Postfix) with ESMTP id 3F0186B0082 for ; Fri, 2 Feb 2024 13:41:50 -0500 (EST) Received: from smtpin26.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay06.hostedemail.com (Postfix) with ESMTP id 1F9C9A26CC for ; Fri, 2 Feb 2024 18:41:50 +0000 (UTC) X-FDA: 81747732780.26.B798C03 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by imf11.hostedemail.com (Postfix) with ESMTP id 58FD34000E for ; Fri, 2 Feb 2024 18:41:48 +0000 (UTC) Authentication-Results: imf11.hostedemail.com; dkim=pass header.d=kernel.org header.s=k20201202 header.b=fbRoRFWP; dmarc=pass (policy=none) header.from=kernel.org; spf=pass (imf11.hostedemail.com: domain of sashal@kernel.org designates 139.178.84.217 as permitted sender) smtp.mailfrom=sashal@kernel.org ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1706899308; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=cE57GD6UFBGC1PYjZ2Kj2A68GExNPmXFO13QcLm7Ze8=; b=4+Rm8ps5JJp/60CGsa13Ksdh/NePmMM9LzDJYoLnXxaiGGf3lhm3K8nlVSd1ICnQREt0yo luJ/Ih5igAwAhBKT33rtRyEc29nF+OZyMS1hEOBTKh4WYVwbkUC/xgfoKBLdlIEj/0S1M2 R+yj1gfPaIHDXuZDwrTXE8AullVFTVw= ARC-Authentication-Results: i=1; imf11.hostedemail.com; dkim=pass header.d=kernel.org header.s=k20201202 header.b=fbRoRFWP; dmarc=pass (policy=none) header.from=kernel.org; spf=pass (imf11.hostedemail.com: domain of sashal@kernel.org designates 139.178.84.217 as permitted sender) smtp.mailfrom=sashal@kernel.org ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1706899308; a=rsa-sha256; cv=none; b=ACEg/f3bylvKXRyWnSBLknKjW+u1Y3rbXTk9k6PtsIJoDNvymxFdsHTZW6D8oacgmsjTlX 7uQqTXLF317IsCuI8rQkmqaqPPE9NeMCRVfyjj6jfgzg8kgPHA+Ru9xRhmWHNo1IRAj9d6 aJ6Rrx4E9RZRGzZ5ZtRd/hE9hu+W+Wc= Received: from smtp.kernel.org (transwarp.subspace.kernel.org [100.75.92.58]) by dfw.source.kernel.org (Postfix) with ESMTP id 6BC1F627F0; Fri, 2 Feb 2024 18:41:47 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 94CF7C43394; Fri, 2 Feb 2024 18:41:44 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1706899307; bh=axD4Mij+aQBMobeLf678/tZTD/zRKamci0mbWK48h3M=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=fbRoRFWPo/BKEpW+Fn3ubkYtTEMqYcQFeUxz7ki1i7/3apA61C0GZ9mG5lrpruHN1 aginZPLgH4YbSFx0BSb6HxrQVgF+h8ZBY9+LX63+EfB35C8TaQzZ/PIYTLXz5Ifn8S Utx3u8Kbe++XxH/wab6LfX0hEiEuyPFEPTwj3NDtLtkH43kREtmh7SG09+TU1wMgnZ TT8ovHrgHztDg8WBddQuiuvbhr/kSbGYg6HKv4L9pWWsk+dc3cW3Hd9sgBSzjF4JPX +UjXyGn83Dz452jCqakKVOVDdZDn8Ep2hfBjYtF4iEvfSTQhbeGkkLTYuI9rgBda/1 BC8/fh0PR/hQg== From: Sasha Levin To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Kees Cook , Kentaro Takeda , Tetsuo Handa , Alexander Viro , Christian Brauner , Jan Kara , Eric Biederman , Andrew Morton , Sebastian Andrzej Siewior , linux-fsdevel@vger.kernel.org, linux-mm@kvack.org, Sasha Levin , mingo@redhat.com, peterz@infradead.org, juri.lelli@redhat.com, vincent.guittot@linaro.org, surenb@google.com, mst@redhat.com, michael.christie@oracle.com, mjguzik@gmail.com, npiggin@gmail.com, zhangpeng.00@bytedance.com, hca@linux.ibm.com Subject: [PATCH AUTOSEL 5.15 08/11] exec: Distinguish in_execve from in_exec Date: Fri, 2 Feb 2024 13:41:22 -0500 Message-ID: <20240202184130.541736-8-sashal@kernel.org> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20240202184130.541736-1-sashal@kernel.org> References: <20240202184130.541736-1-sashal@kernel.org> MIME-Version: 1.0 X-stable: review X-Patchwork-Hint: Ignore X-stable-base: Linux 5.15.148 Content-Transfer-Encoding: 8bit X-Rspam-User: X-Stat-Signature: 7y3xemxba5rjcmt4bejip6mouzd41a8u X-Rspamd-Server: rspam07 X-Rspamd-Queue-Id: 58FD34000E X-HE-Tag: 1706899308-579766 X-HE-Meta: U2FsdGVkX19DMY2RPSIepLJcscgvx5APptVXcxSca0MZyhO/Vq3jHt6mR6ol9ftQ2z3+sl8TQvygq7rBjvgLX25vFpPKb92wQ8OW1vcztrbM4ym81ik7Vk1Q3APh5sBnkZ17wjxtyPPefs2uErQbsMBYTYTU5OCdSeoOHmErh5XLd8MtMA2lfnHpeWdwA7G7yp9zstYz/l3b2XLkUzpBuFrkSoZHsjCbAujFd1dkIY7TFpGT/53Ssy5kG/Cgs4QlaS5k+YSacm0tjsDt6n1nxusx9wuktkTTDKf6vWj86LQswOfWrnGtl35CTF/YhBzqc2RnsV4PsXn1OlTJfriN8opfrFRX1ZnBywB4HUSPkQFuNsjsUSYOc0DzQMH3nrzscmdeRo53JjlQ/LscHojyquABxZuGVJOY/UrUHdjT5duFMwx/VKlCrmDDmk2MeNXkJ3E7nUGy3AXdFqEUiHrSlAu/IetHkKmBYjX6TBrdgR74HEx+j48bZBSsm8LPgfoBQCdAUkihY6gXdXvK2F/NpBVVmj9VeJA9lW8JfVJJt0xXQsrdHkEkX72Qo2VwxGbneQ5Srn4S/sy46D7i0gPOYAkeMfMl9D2QZvtwkFLefOKHceGhRNRgDAgZrmwpcTsk6Xbi1Wu/5Sluf07phN7rvMoiqHZt6VIug2pqwnWDLgmNpXIhgRIOD/UXclRENMG2f2fr9ZbD4hHDTSZv656tP/hhd0iiSDwahSLBunxu6DY+bw1WONA19ZGvsG/vJx4Sb/UTBIV9hY4qGKgK+UVtNjAHW44sNsowH0yhCXsbcaSx5FHgwMVW33VqqcH1x0f2AZxY86/ioJVYoCKpUqdd0yvByeD6WzX+WwgvYa+3/m4ttm/n8AdW3eo1Mqw0HoMj4vIst3+rh8WFnciPdPKe0rzzHK0xQh/I6qQrjQZLcYYm8GcJi6HyeNo5ycWhhvZEBvtNheVvzbSlz3LxJWk /YRvysnp zdpMBoKDnIvMR/+otkNVGQyY8TcFs+QYu0HucFfRotQPCs0SaLUvzOUC0aUjDZfywt7hTymmP3Zr/rugtqD3RAcJsITSdu65k+/1nV0ha2+ni4Y6xGikZrXoN/rI986pYd1n0EMw9t4lipuPKrjnEqStuZEIJNCqOAogvk1kdQ09ONC9uvfBB49em2Qrxr+yxUDlIUxvKCS503J4e8HbLbbjf/hTIaLW7Y7mh879ndjIeLzeAJzXNDotCuSs8WJCTw9KGtedswHo5cnB6g5sTxLZN0Oo4ihLPaqtgp8ig5Tf3ihtIMO2yCJxMiWhAd2bkORjQXaIfXprcP4XHD0Tgyiw7LAuMBJw3vgZ7IJP9Kyea91N0848MiH+z6MoFS5IK0CQaHCQjz1qLuEimXfroqETmAJnjUDGIwk6JOjGLWzaMg2Jq28/k9z2xV5XE0IM1ERXqrMaw+lHdzdguyR8SZphAfYwwcva8ihne7U2HLDI2Iu4vBE0WFxi/L80eIa7QrjUNphfBhCSurGtZfgtzBnKU+QzPPthdIjyhIcgNedc03ByOtuThkUePAf6bklEb6IcTAif9OvmzHJY= X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: From: Kees Cook [ Upstream commit 90383cc07895183c75a0db2460301c2ffd912359 ] Just to help distinguish the fs->in_exec flag from the current->in_execve flag, add comments in check_unsafe_exec() and copy_fs() for more context. Also note that in_execve is only used by TOMOYO now. Cc: Kentaro Takeda Cc: Tetsuo Handa Cc: Alexander Viro Cc: Christian Brauner Cc: Jan Kara Cc: Eric Biederman Cc: Andrew Morton Cc: Sebastian Andrzej Siewior Cc: linux-fsdevel@vger.kernel.org Cc: linux-mm@kvack.org Signed-off-by: Kees Cook Signed-off-by: Sasha Levin --- fs/exec.c | 1 + include/linux/sched.h | 2 +- kernel/fork.c | 1 + 3 files changed, 3 insertions(+), 1 deletion(-) diff --git a/fs/exec.c b/fs/exec.c index 881390b44cfd..5895f74b252b 100644 --- a/fs/exec.c +++ b/fs/exec.c @@ -1584,6 +1584,7 @@ static void check_unsafe_exec(struct linux_binprm *bprm) } rcu_read_unlock(); + /* "users" and "in_exec" locked for copy_fs() */ if (p->fs->users > n_fs) bprm->unsafe |= LSM_UNSAFE_SHARE; else diff --git a/include/linux/sched.h b/include/linux/sched.h index 7bfc2b45cd99..4b88f57130aa 100644 --- a/include/linux/sched.h +++ b/include/linux/sched.h @@ -902,7 +902,7 @@ struct task_struct { */ unsigned sched_remote_wakeup:1; - /* Bit to tell LSMs we're in execve(): */ + /* Bit to tell TOMOYO we're in execve(): */ unsigned in_execve:1; unsigned in_iowait:1; #ifndef TIF_RESTORE_SIGMASK diff --git a/kernel/fork.c b/kernel/fork.c index 753e641f617b..b9f61c26c1d0 100644 --- a/kernel/fork.c +++ b/kernel/fork.c @@ -1530,6 +1530,7 @@ static int copy_fs(unsigned long clone_flags, struct task_struct *tsk) if (clone_flags & CLONE_FS) { /* tsk->fs is already what we want */ spin_lock(&fs->lock); + /* "users" and "in_exec" locked for check_unsafe_exec() */ if (fs->in_exec) { spin_unlock(&fs->lock); return -EAGAIN; -- 2.43.0