From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4CBD8C4332F for ; Fri, 14 Oct 2022 03:18:34 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id D0C5D6B0072; Thu, 13 Oct 2022 23:18:33 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id CBC2E6B0075; Thu, 13 Oct 2022 23:18:33 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id B35E26B0078; Thu, 13 Oct 2022 23:18:33 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0013.hostedemail.com [216.40.44.13]) by kanga.kvack.org (Postfix) with ESMTP id 9FB726B0072 for ; Thu, 13 Oct 2022 23:18:33 -0400 (EDT) Received: from smtpin07.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay06.hostedemail.com (Postfix) with ESMTP id 7375AAACEC for ; Fri, 14 Oct 2022 03:18:33 +0000 (UTC) X-FDA: 80018097306.07.F45B7AB Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by imf14.hostedemail.com (Postfix) with ESMTP id D4C96100022 for ; Fri, 14 Oct 2022 03:18:32 +0000 (UTC) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 0654FB821B3; Fri, 14 Oct 2022 03:18:31 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id AE094C43470; Fri, 14 Oct 2022 03:18:28 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1665717509; bh=XdPGgMOKnebM+bZev/ZKP6wiusPUf6c3wma5ZTnpm0o=; h=In-Reply-To:References:Date:From:To:Cc:Subject:From; b=TCqLtjMUhY3E6hf1ob6xgOd/SwpJweBv3tU3uwDefMm4A/ahGMxIC1fYKYYfBlwsp c4OzGNUkyZI/EWcYPFYJKey7rW0cEUkZE+LOkpGV19buQ6rtAwI/hLX5iw1NyHEOWp FqFekRHYzRsrNlju7lbJW+OBW4KWCrNhryyrvGL4FXB9xq9XMqweABSa7E89pobMDj dhbr4pgnLECh4yJxmSvj30PN6CSkv/1SL630AvtuHSSPF+716FXaWyEJPJV5YfWvUX AcpoA4Go3xPK5zpt0aNt/TWRQOKwqnAINiTRleYiI5qW8pa8hRcvsqQddsl387N9qW FvzX+DBznhG0Q== Received: from compute2.internal (compute2.nyi.internal [10.202.2.46]) by mailauth.nyi.internal (Postfix) with ESMTP id 7304527C0054; Thu, 13 Oct 2022 23:18:27 -0400 (EDT) Received: from imap48 ([10.202.2.98]) by compute2.internal (MEProxy); Thu, 13 Oct 2022 23:18:27 -0400 X-ME-Sender: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgedvfedrfeekuddgieelucetufdoteggodetrfdotf fvucfrrhhofhhilhgvmecuhfgrshhtofgrihhlpdfqfgfvpdfurfetoffkrfgpnffqhgen uceurghilhhouhhtmecufedttdenucesvcftvggtihhpihgvnhhtshculddquddttddmne cujfgurhepofgfggfkjghffffhvfevufgtsehttdertderredtnecuhfhrohhmpedftehn ugihucfnuhhtohhmihhrshhkihdfuceolhhuthhosehkvghrnhgvlhdrohhrgheqnecugg ftrfgrthhtvghrnhepgeejhfehkeejleffheetkefhtdduuedtieehheekgfekudeggfff udejuddufeeknecuffhomhgrihhnpegthhhrohhmihhumhdrohhrghenucevlhhushhtvg hrufhiiigvpedtnecurfgrrhgrmhepmhgrihhlfhhrohhmpegrnhguhidomhgvshhmthhp rghuthhhphgvrhhsohhnrghlihhthidqudduiedukeehieefvddqvdeifeduieeitdekqd hluhhtoheppehkvghrnhgvlhdrohhrgheslhhinhhugidrlhhuthhordhush X-ME-Proxy: Feedback-ID: ieff94742:Fastmail Received: by mailuser.nyi.internal (Postfix, from userid 501) id 878A331A03F7; Thu, 13 Oct 2022 23:18:25 -0400 (EDT) X-Mailer: MessagingEngine.com Webmail Interface User-Agent: Cyrus-JMAP/3.7.0-alpha0-1047-g9e4af4ada4-fm-20221005.001-g9e4af4ad Mime-Version: 1.0 Message-Id: <2032f766-1704-486b-8f24-a670c0b3cb32@app.fastmail.com> In-Reply-To: References: <20221006082735.1321612-1-keescook@chromium.org> <20221006082735.1321612-2-keescook@chromium.org> <20221006090506.paqjf537cox7lqrq@wittgenstein> Date: Thu, 13 Oct 2022 20:18:04 -0700 From: "Andy Lutomirski" To: "Jann Horn" , "Christian Brauner" Cc: "Kees Cook" , "Eric W. Biederman" , "Jorge Merlino" , "Al Viro" , "Thomas Gleixner" , "Sebastian Andrzej Siewior" , "Andrew Morton" , linux-mm@kvack.org, linux-fsdevel@vger.kernel.org, "John Johansen" , "Paul Moore" , "James Morris" , "Serge E. Hallyn" , "Stephen Smalley" , "Eric Paris" , "Richard Haines" , "Casey Schaufler" , "Xin Long" , "David S. Miller" , "Todd Kjos" , "Ondrej Mosnacek" , "Prashanth Prahlad" , "Micah Morton" , "Fenghua Yu" , "Andrei Vagin" , "Linux Kernel Mailing List" , apparmor@lists.ubuntu.com, linux-security-module@vger.kernel.org, selinux@vger.kernel.org, linux-hardening@vger.kernel.org Subject: Re: [PATCH 1/2] fs/exec: Explicitly unshare fs_struct on exec Content-Type: text/plain ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1665717513; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=KvxDJx5zOu00qbNqJPi5qC/MLlKEgI3Wyos+eU+li2Y=; b=6bWPlxCokpMDnmdnGyeR4ncgSUKG2wigo7ZhxAEIMzM2w5Im8nfw2l8C089vM7JvrNmf3s e4soZF2JZoU1zIM7SFabXWswDIOE9LBvYNDakHKS6HpcWwuH7HBmGt+G3sjxzvgy1chPGP tOw5yEaHfEn/KdYgYjO/IN35BteZawU= ARC-Authentication-Results: i=1; imf14.hostedemail.com; dkim=pass header.d=kernel.org header.s=k20201202 header.b=TCqLtjMU; spf=pass (imf14.hostedemail.com: domain of luto@kernel.org designates 145.40.68.75 as permitted sender) smtp.mailfrom=luto@kernel.org; dmarc=pass (policy=none) header.from=kernel.org ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1665717513; a=rsa-sha256; cv=none; b=xGsp8YItswZn8q6W8dtoKW1opPa5w4363Pi/1G2QLsgo2ZNsWs/ZLZ8YIF+r3GXe+nKk0u /lEwnN+Os9nWhugtG1gBmgL4w26D4zbTw4oMUseT6gbNclGX+dQzWYRbUxI1jFBC+Ym4I6 JcnaQ10mZUF2dATa3HRPcgXAUCNqiN0= X-Rspam-User: X-Rspamd-Server: rspam11 Authentication-Results: imf14.hostedemail.com; dkim=pass header.d=kernel.org header.s=k20201202 header.b=TCqLtjMU; spf=pass (imf14.hostedemail.com: domain of luto@kernel.org designates 145.40.68.75 as permitted sender) smtp.mailfrom=luto@kernel.org; dmarc=pass (policy=none) header.from=kernel.org X-Stat-Signature: xsxd4oq7t41cd7mrctt5c6kx1cwq76xm X-Rspamd-Queue-Id: D4C96100022 X-HE-Tag: 1665717512-455997 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Thu, Oct 6, 2022, at 7:13 AM, Jann Horn wrote: > On Thu, Oct 6, 2022 at 11:05 AM Christian Brauner wrote: >> On Thu, Oct 06, 2022 at 01:27:34AM -0700, Kees Cook wrote: >> > The check_unsafe_exec() counting of n_fs would not add up under a heavily >> > threaded process trying to perform a suid exec, causing the suid portion >> > to fail. This counting error appears to be unneeded, but to catch any >> > possible conditions, explicitly unshare fs_struct on exec, if it ends up >> >> Isn't this a potential uapi break? Afaict, before this change a call to >> clone{3}(CLONE_FS) followed by an exec in the child would have the >> parent and child share fs information. So if the child e.g., changes the >> working directory post exec it would also affect the parent. But after >> this change here this would no longer be true. So a child changing a >> workding directoro would not affect the parent anymore. IOW, an exec is >> accompanied by an unshare(CLONE_FS). Might still be worth trying ofc but >> it seems like a non-trivial uapi change but there might be few users >> that do clone{3}(CLONE_FS) followed by an exec. > > I believe the following code in Chromium explicitly relies on this > behavior, but I'm not sure whether this code is in active use anymore: > > https://source.chromium.org/chromium/chromium/src/+/main:sandbox/linux/suid/sandbox.c;l=101?q=CLONE_FS&sq=&ss=chromium Wait, this is absolutely nucking futs. On a very quick inspection, the sharable things like this are fs, files, sighand, and io. files and sighand get unshared, which makes sense. fs supposedly checks for extra refs and prevents gaining privilege. io is... ignored! At least it's not immediately obvious that io is a problem. But seriously, this makes no sense at all. It should not be possible to exec a program and then, without ptrace, change its cwd out from under it. Do we really need to preserve this behavior? --Andy