Skip to contentSkip to conversation

capabilities: fix sys_prctl() returned uninitialized value

PATCH In review Shi Weihua 2 participants 3 messages May 21, 2008 – May 22, 2008

Subsystems (2)
Security (LSM) Capabilities
lore
Share & tools
lore

Shi Weihua

author
#0 lore raw

PATCH 1/1 capabilities: fix sys_prctl() returned uninitialized value

When we test kernel by the latest LTP(20080430) on ia64, the following failure occured:
-------------------------------------

prctl01     1  PASS  :  Test Passed
prctl01     0  WARN  :  prctl() returned 2048 errno = 0 : Success
prctl01     1  PASS  :  Test Passed
prctl01     2  FAIL  :  Test Failed

-------------------------------------

We found commit 3898b1b4ebff8dcfbcf1807e0661585e06c9a91c causes this failure by git-bisect.
And, we found *rc_p has not been initialized if switch-default of the function cap_task_prctl()(security/commoncap.c). When *rc_p uninitialized, sys_prctl() will return a wrong value.

Signed-off-by Shi Weihua <[email protected]>

---

security/commoncap.c +1 -0
index 5edabc7..a4b28c8 100644
@@ -649,6 +649,7 @@ int cap_task_prctl(int option, unsigned long arg2, unsigned long arg3,
 
 	default:
 		/* No functionality available - continue with default */
+		*rc_p = 0;
 		return 0;
 	}
#1 lore raw
Quoted 22 lines · Shi Weihua

When we test kernel by the latest LTP(20080430) on ia64, the following failure occured:
-------------------------------------

prctl01     1  PASS  :  Test Passed
prctl01     0  WARN  :  prctl() returned 2048 errno = 0 : Success
prctl01     1  PASS  :  Test Passed
prctl01     2  FAIL  :  Test Failed

-------------------------------------

We found commit 3898b1b4ebff8dcfbcf1807e0661585e06c9a91c causes this failure by git-bisect.
And, we found *rc_p has not been initialized if switch-default of the function cap_task_prctl()(security/commoncap.c). When *rc_p uninitialized, sys_prctl() will return a wrong value.

Signed-off-by Shi Weihua <[email protected]>

---

security/commoncap.c +0 -0
index 5edabc7..a4b28c8 100644

security/commoncap.c int cap_task_prctl(int option, unsigned long arg2, unsigned long arg3, · line 654

Quoted 6 lines
security/commoncap.c +1 -0
@@ -649,6 +649,7 @@ int cap_task_prctl(int option, unsigned long arg2, unsigned long arg3,
 
 	default:
 		/* No functionality available - continue with default */
+		*rc_p = 0;
 		return 0;
 	}

No, this case here means that the capability module is not taking responsibility for this call. So it should not be setting rc_p.

So you'll want to find another path in kernel/sys.c:sys_prctl() where error doesn't get set. Do you know what 'i' was in prctl01 at the time of failure?

For instance, I notice that PR_SET_DUMPABLE doesn't set the value of error if arg2 is valid. Also PR_SET_NAME and PR_GET_NAME don't set error.

-serge

author
#2 lore raw
Quoted 24 lines · Serge E. Hallyn
Quoted 23 lines · Shi Weihua

When we test kernel by the latest LTP(20080430) on ia64, the following failure occured:
-------------------------------------

prctl01     1  PASS  :  Test Passed
prctl01     0  WARN  :  prctl() returned 2048 errno = 0 : Success
prctl01     1  PASS  :  Test Passed
prctl01     2  FAIL  :  Test Failed

-------------------------------------

We found commit 3898b1b4ebff8dcfbcf1807e0661585e06c9a91c causes this failure by git-bisect.
And, we found *rc_p has not been initialized if switch-default of the function cap_task_prctl()(security/commoncap.c). When *rc_p uninitialized, sys_prctl() will return a wrong value.

Signed-off-by Shi Weihua <[email protected]>

---

security/commoncap.c +0 -0
index 5edabc7..a4b28c8 100644
@@ -649,6 +649,7 @@ int cap_task_prctl(int option, unsigned long arg2, unsigned long arg3,
Quoted 8 lines

security/commoncap.c int cap_task_prctl(int option, unsigned long arg2, unsigned long arg3, · line 654

Quoted 5 lines
security/commoncap.c +1 -0
 	default:
 		/* No functionality available - continue with default */
+		*rc_p = 0;
 		return 0;
 	}

No, this case here means that the capability module is not taking responsibility for this call. So it should not be setting rc_p.

Ok, we noticed the comment as following in include/linux/security.h.
+ * @rc_p contains a pointer to communicate back the forced return code
+ * Return 0 if permission is granted, and non-zero if the security module
+ * has taken responsibility (setting *rc_p) for the prctl call.

Quoted 4 lines

So you'll want to find another path in kernel/sys.c:sys_prctl() where error doesn't get set. Do you know what 'i' was in prctl01 at the time of failure?

'i' was 1 (PR_SET_PDEATHSIG).

I will create a new patch ASAP.

Thanks.

Quoted 9 lines

For instance, I notice that PR_SET_DUMPABLE doesn't set the value of error if arg2 is valid. Also PR_SET_NAME and PR_GET_NAME don't set error.

-serge