setgid hardening
Get series with b4
b4 am [email protected]Versions newest first · linked by author and title
- v2 Latest2 patches 7 repliesIn review
- v12 patches 9 repliesSuperseded
Changes in v2 from the cover letter
- Fix uninitialized variable issue (Willy, Ben)
- Also check current creds in should_remove_suid() (Ben)
Patches in v2 No applies recorded yet
| # | Subject and files | Size | Replies | Applied |
|---|---|---|---|---|
| 1/2 | fs: Check f_cred as well as of current's creds in should_remove_suid()fs/ fs/ fs/ +2 more | +36 | 2 replies | |
| 2/2 | fs: Harden against open(..., O_CREAT, 02777) in a setgid directoryfs/ | +21 | 3 replies |
Reviews trailers per patch
All 2 patches have a Reviewed-by or Acked-by.
| Patch | Jeff Layton |
|---|---|
| 1/2 | R-b |
| 2/2 | R-b |
Trailers given in replies are filled; those carried in the patches from earlier versions are outlined with dashes.
Cover letter [PATCH v2 0/2] setgid hardening
The kernel has some dangerous behavior involving the creation and modification of setgid executables. These issues aren't kernel security bugs per se, but they have been used to turn various filesystem permission oddities into reliably privilege escalation exploits.
See http://www.halfdog.net/Security/2015/SetgidDirectoryPrivilegeEscalation/
for a nice writeup.
Let's fix them for real.
Changes from v1:
- Fix uninitialized variable issue (Willy, Ben)
- Also check current creds in should_remove_suid() (Ben)
Andy Lutomirski (2):
fs: Check f_cred as well as of current's creds in should_remove_suid()
fs: Harden against open(..., O_CREAT, 02777) in a setgid directory
fs/inode.c | 61 ++++++++++++++++++++++++++++++++++++++++++++++-------- fs/internal.h | 2 +- fs/ocfs2/file.c | 4 ++-- fs/open.c | 2 +- include/linux/fs.h | 2 +- 5 files changed, 57 insertions(+), 14 deletions(-)
Signature · 7 lines
2.9.3 -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to [email protected]. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: <a href=mailto:"[email protected]"> [email protected] </a>