namei: Allow restricted O_CREAT of FIFOs and regular files

PATCH In review Kees Cook 2 participants 2 messages Apr 16, 2018 – Apr 17, 2018

Subsystems (3)

Documentation VFS Proc sysctl

lore

Share & tools

lore

Kees Cook

author

2018-04-16 17:59 UTC #0 lore raw

PATCH v5 1/1 namei: Allow restricted O_CREAT of FIFOs and regular files

From: Salvatore Mesoraca <[email protected]>

Disallows open of FIFOs or regular files not owned by the user in world writable sticky directories, unless the owner is the same as that of the directory or the file is opened without the O_CREAT flag. The purpose is to make data spoofing attacks harder. This protection can be turned on and off separately for FIFOs and regular files via sysctl, just like the symlinks/hardlinks protection. This patch is based on Openwall's "HARDEN_FIFO" feature by Solar Designer.

This is a brief list of old vulnerabilities that could have been prevented by this feature, some of them even allow for privilege escalation:
CVE-2000-1134
CVE-2007-3852
CVE-2008-0525
CVE-2009-0416
CVE-2011-4834
CVE-2015-1838
CVE-2015-7442
CVE-2016-7489

This list is not meant to be complete. It's difficult to track down all vulnerabilities of this kind because they were often reported without any mention of this particular attack vector. In fact, before hardlinks/symlinks restrictions, fifos/regular files weren't the favorite vehicle to exploit them.

Suggested-by Kees Cook <[email protected]>

Signed-off-by Salvatore Mesoraca <[email protected]>

[kees: drop pr_warn_ratelimited() in favor of audit changes in the future]

[kees: adjust commit subjet]

Signed-off-by Kees Cook <[email protected]>

---
 Documentation/sysctl/fs.txt | 36 +++++++++++++++++++++++++++++++
 fs/namei.c                  | 52 ++++++++++++++++++++++++++++++++++++++++++---
 include/linux/fs.h          |  2 ++
 kernel/sysctl.c             | 18 ++++++++++++++++
 4 files changed, 105 insertions(+), 3 deletions(-)

Documentation/sysctl/fs.txt +36 -0

index 6c00c1e2743f..819caf8ca05f 100644
@@ -34,7 +34,9 @@ Currently, these files are in /proc/sys/fs:
 - overflowgid
 - pipe-user-pages-hard
 - pipe-user-pages-soft
+- protected_fifos
 - protected_hardlinks
+- protected_regular
 - protected_symlinks
 - suid_dumpable
 - super-max

@@ -182,6 +184,24 @@ applied.
 
 ==============================================================
 
+protected_fifos:
+
+The intent of this protection is to avoid unintentional writes to
+an attacker-controlled FIFO, where a program expected to create a regular
+file.
+
+When set to "0", writing to FIFOs is unrestricted.
+
+When set to "1" don't allow O_CREAT open on FIFOs that we don't own
+in world writable sticky directories, unless they are owned by the
+owner of the directory.
+
+When set to "2" it also applies to group writable sticky directories.
+
+This protection is based on the restrictions in Openwall.
+
+==============================================================
+
 protected_hardlinks:
 
 A long-standing class of security issues is the hardlink-based

@@ -202,6 +222,22 @@ This protection is based on the restrictions in Openwall and grsecurity.
 
 ==============================================================
 
+protected_regular:
+
+This protection is similar to protected_fifos, but it
+avoids writes to an attacker-controlled regular file, where a program
+expected to create one.
+
+When set to "0", writing to regular files is unrestricted.
+
+When set to "1" don't allow O_CREAT open on regular files that we
+don't own in world writable sticky directories, unless they are
+owned by the owner of the directory.
+
+When set to "2" it also applies to group writable sticky directories.
+
+==============================================================
+
 protected_symlinks:
 
 A long-standing class of security issues is the symlink-based

fs/namei.c +49 -3

70 lines not on this page · raw message

include/linux/fs.h +2 -0

index 760d8da1b6c7..dbd4ae431910 100644
@@ -73,6 +73,8 @@ extern struct inodes_stat_t inodes_stat;
 extern int leases_enable, lease_break_time;
 extern int sysctl_protected_symlinks;
 extern int sysctl_protected_hardlinks;
+extern int sysctl_protected_fifos;
+extern int sysctl_protected_regular;
 
 typedef __kernel_rwf_t rwf_t;

kernel/sysctl.c +18 -0

index 6a78cf70761d..f45ed9e696eb 100644
@@ -1805,6 +1805,24 @@ static struct ctl_table fs_table[] = {
 		.extra2		= &one,
 	},
 	{
+		.procname	= "protected_fifos",
+		.data		= &sysctl_protected_fifos,
+		.maxlen		= sizeof(int),
+		.mode		= 0600,
+		.proc_handler	= proc_dointvec_minmax,
+		.extra1		= &zero,
+		.extra2		= &two,
+	},
+	{
+		.procname	= "protected_regular",
+		.data		= &sysctl_protected_regular,
+		.maxlen		= sizeof(int),
+		.mode		= 0600,
+		.proc_handler	= proc_dointvec_minmax,
+		.extra1		= &zero,
+		.extra2		= &two,
+	},
+	{
 		.procname	= "suid_dumpable",
 		.data		= &suid_dumpable,
 		.maxlen		= sizeof(int),

Signature · 6 lines

2.7.4


-- 
Kees Cook
Pixel Security

Andrew Morton

2018-04-17 22:17 UTC #1 lore raw

Quoted 19 lines · On Mon, 16 Apr 2018 10:59:18 -0700 Kees Cook <[email protected]> wrote:

Disallows open of FIFOs or regular files not owned by the user in world writable sticky directories, unless the owner is the same as that of the directory or the file is opened without the O_CREAT flag. The purpose is to make data spoofing attacks harder. This protection can be turned on and off separately for FIFOs and regular files via sysctl, just like the symlinks/hardlinks protection. This patch is based on Openwall's "HARDEN_FIFO" feature by Solar Designer.
This is a brief list of old vulnerabilities that could have been prevented by this feature, some of them even allow for privilege escalation:
CVE-2000-1134
CVE-2007-3852
CVE-2008-0525
CVE-2009-0416
CVE-2011-4834
CVE-2015-1838
CVE-2015-7442
CVE-2016-7489

Quoted 5 lines

This list is not meant to be complete. It's difficult to track down all vulnerabilities of this kind because they were often reported without any mention of this particular attack vector. In fact, before hardlinks/symlinks restrictions, fifos/regular files weren't the favorite vehicle to exploit them.

Well, I'll toss it in there, but would much prefer it if Al were to take a look, please.

From: Salvatore Mesoraca <[email protected]>
Subject: namei: allow restricted O_CREAT of FIFOs and regular files

This is a brief list of old vulnerabilities that could have been prevented by this feature, some of them even allow for privilege escalation:

CVE-2000-1134
CVE-2007-3852
CVE-2008-0525
CVE-2009-0416
CVE-2011-4834
CVE-2015-1838
CVE-2015-7442
CVE-2016-7489

[[email protected]: drop pr_warn_ratelimited() in favor of audit changes in the future]

[[email protected]: adjust commit subjet]

Link http://lkml.kernel.org/r/20180416175918.GA13494@beast open here

Signed-off-by Salvatore Mesoraca <[email protected]>

Signed-off-by Kees Cook <[email protected]>

Suggested-by Kees Cook <[email protected]>

Cc Al Viro <[email protected]>

Signed-off-by Andrew Morton <[email protected]>

---

 Documentation/sysctl/fs.txt |   36 +++++++++++++++++++++++
 fs/namei.c                  |   52 ++++++++++++++++++++++++++++++++--
 include/linux/fs.h          |    2 +
 kernel/sysctl.c             |   18 +++++++++++
 4 files changed, 105 insertions(+), 3 deletions(-)

Documentation/sysctl/fs.txt renamed from Documentation/sysctl/fs.txt~namei-allow-restricted-o_creat-of-fifos-and-regular-files +36 -0

diff -puN Documentation/sysctl/fs.txt~namei-allow-restricted-o_creat-of-fifos-and-regular-files Documentation/sysctl/fs.txt
@@ -34,7 +34,9 @@ Currently, these files are in /proc/sys/
 - overflowgid
 - pipe-user-pages-hard
 - pipe-user-pages-soft
+- protected_fifos
 - protected_hardlinks
+- protected_regular
 - protected_symlinks
 - suid_dumpable
 - super-max

@@ -182,6 +184,24 @@ applied.
 
 ==============================================================
 
+protected_fifos:
+
+The intent of this protection is to avoid unintentional writes to
+an attacker-controlled FIFO, where a program expected to create a regular
+file.
+
+When set to "0", writing to FIFOs is unrestricted.
+
+When set to "1" don't allow O_CREAT open on FIFOs that we don't own
+in world writable sticky directories, unless they are owned by the
+owner of the directory.
+
+When set to "2" it also applies to group writable sticky directories.
+
+This protection is based on the restrictions in Openwall.
+
+==============================================================
+
 protected_hardlinks:
 
 A long-standing class of security issues is the hardlink-based

@@ -202,6 +222,22 @@ This protection is based on the restrict
 
 ==============================================================
 
+protected_regular:
+
+This protection is similar to protected_fifos, but it
+avoids writes to an attacker-controlled regular file, where a program
+expected to create one.
+
+When set to "0", writing to regular files is unrestricted.
+
+When set to "1" don't allow O_CREAT open on regular files that we
+don't own in world writable sticky directories, unless they are
+owned by the owner of the directory.
+
+When set to "2" it also applies to group writable sticky directories.
+
+==============================================================
+
 protected_symlinks:
 
 A long-standing class of security issues is the symlink-based

fs/namei.c renamed from fs/namei.c~namei-allow-restricted-o_creat-of-fifos-and-regular-files +49 -3

70 lines not on this page · raw message

include/linux/fs.h renamed from include/linux/fs.h~namei-allow-restricted-o_creat-of-fifos-and-regular-files +2 -0

diff -puN include/linux/fs.h~namei-allow-restricted-o_creat-of-fifos-and-regular-files include/linux/fs.h
@@ -73,6 +73,8 @@ extern struct inodes_stat_t inodes_stat;
 extern int leases_enable, lease_break_time;
 extern int sysctl_protected_symlinks;
 extern int sysctl_protected_hardlinks;
+extern int sysctl_protected_fifos;
+extern int sysctl_protected_regular;
 
 typedef __kernel_rwf_t rwf_t;

kernel/sysctl.c renamed from kernel/sysctl.c~namei-allow-restricted-o_creat-of-fifos-and-regular-files +18 -0

diff -puN kernel/sysctl.c~namei-allow-restricted-o_creat-of-fifos-and-regular-files kernel/sysctl.c
@@ -1805,6 +1805,24 @@ static struct ctl_table fs_table[] = {
 		.extra2		= &one,
 	},
 	{
+		.procname	= "protected_fifos",
+		.data		= &sysctl_protected_fifos,
+		.maxlen		= sizeof(int),
+		.mode		= 0600,
+		.proc_handler	= proc_dointvec_minmax,
+		.extra1		= &zero,
+		.extra2		= &two,
+	},
+	{
+		.procname	= "protected_regular",
+		.data		= &sysctl_protected_regular,
+		.maxlen		= sizeof(int),
+		.mode		= 0600,
+		.proc_handler	= proc_dointvec_minmax,
+		.extra1		= &zero,
+		.extra2		= &two,
+	},
+	{
 		.procname	= "suid_dumpable",
 		.data		= &suid_dumpable,
 		.maxlen		= sizeof(int),