exec: use -ELOOP for max recursion depth
Subsystems (2)
PATCH 1/1 exec: use -ELOOP for max recursion depth
To avoid an explosion of request_module calls on a chain of abusive scripts, fail maximum recursion with -ELOOP instead of -ENOEXEC. As soon as maximum recursion depth is hit, the error will fail all the way back up the chain, aborting immediately.
This also has the side-effect of stopping the user's shell from attempting to reexecute the top-level file as a shell script. As seen in the dash source:
if (cmd != path_bshell && errno == ENOEXEC) {
*argv-- = cmd;
*argv = cmd = path_bshell;
goto repeat;
}The above logic was designed for running scripts automatically that lacked the "#!" header, not to re-try failed recursion. On a legitimate -ENOEXEC, things continue to behave as the shell expects.
Additionally, when tracking recursion, the binfmt handlers should not be involved. The recursion being tracked is the depth of calls through search_binary_handler(), so that function should be exclusively responsible for tracking the depth.
--- fs/binfmt_em86.c | 1 - fs/binfmt_misc.c | 6 ------ fs/binfmt_script.c | 4 +--- fs/exec.c | 10 +++++----- include/linux/binfmts.h | 2 -- 5 files changed, 6 insertions(+), 17 deletions(-)
fs/binfmt_em86.c +0 -1
@@ -42,7 +42,6 @@ static int load_em86(struct linux_binprm *bprm,struct pt_regs *regs)return -ENOEXEC ; } - bprm->recursion_depth++;/* Well, the bang-shell is implicit... */ allow_write_access (bprm->file);fput (bprm->file); bprm->file =NULL ;
fs/binfmt_misc.c +0 -6
@@ -117,10 +117,6 @@ static int load_misc_binary(struct linux_binprm *bprm, struct pt_regs *regs)if (!enabled) goto _ret; - retval = -ENOEXEC ; -if (bprm->recursion_depth >BINPRM_MAX_RECURSION ) - goto _ret; -/* to keep locking time low, we copy the interpreter string */ read_lock (&entries_lock); fmt =check_file (bprm);
@@ -200,8 +196,6 @@ static int load_misc_binary(struct linux_binprm *bprm, struct pt_regs *regs)if (retval <0 ) goto _error; - bprm->recursion_depth++; - retval =search_binary_handler (bprm, regs);if (retval <0 ) goto _error;
fs/binfmt_script.c +1 -3
@@ -22,15 +22,13 @@ static int load_script(struct linux_binprm *bprm,struct pt_regs *regs)char interp[BINPRM_BUF_SIZE ];int retval; -if ((bprm->buf[0 ] !='#' ) || (bprm->buf[1 ] !='!' ) || - (bprm->recursion_depth >BINPRM_MAX_RECURSION )) +if ((bprm->buf[0 ] !='#' ) || (bprm->buf[1 ] !='!' ))return -ENOEXEC ;/* * This section does the #! interpretation. * Sorta complicated, but hopefully it will work. -TYT */ - bprm->recursion_depth++;allow_write_access (bprm->file);fput (bprm->file); bprm->file =NULL ;
fs/exec.c +5 -5
@@ -1371,6 +1371,10 @@ int search_binary_handler(struct linux_binprm *bprm,struct pt_regs *regs)struct linux_binfmt *fmt;pid_t old_pid, old_vpid; +/* This allows 4 levels of binfmt rewrites before failing hard. */ +if (depth >5 ) +return -ELOOP ; + retval =security_bprm_check (bprm);if (retval)return retval;
@@ -1395,12 +1399,8 @@ int search_binary_handler(struct linux_binprm *bprm,struct pt_regs *regs)if (!try_module_get (fmt->module))continue ;read_unlock (&binfmt_lock); + bprm->recursion_depth = depth +1 ; retval =fn (bprm, regs); -/* -* Restore the depth counter to its starting value -* in this call, so we don't have to rely on every -* load_binary function to restore it on return. -*/ bprm->recursion_depth = depth;if (retval >=0 ) {if (depth ==0 ) {
include/linux/binfmts.h +0 -2
@@ -54,8 +54,6 @@ struct linux_binprm {#define BINPRM_FLAGS_EXECFD_BIT 1#define BINPRM_FLAGS_EXECFD (1 << BINPRM_FLAGS_EXECFD_BIT) -#define BINPRM_MAX_RECURSION 4 -/* Function parameter for binfmt->coredump */ struct coredump_params {siginfo_t *siginfo;
Signature · 6 lines
1.7.9.5 -- Kees Cook Chrome OS Security