lkdtm: add bad USER_DS test
Subsystems (2)
PATCH v2 1/1 lkdtm: add bad USER_DS test
This adds CORRUPT_USER_DS to check that the get_fs() test on syscall return (via __VERIFY_PRE_USERMODE_STATE) still sees USER_DS. Since trying to deal with values other than USER_DS and KERNEL_DS across all architectures in a safe way is not sensible, this sets KERNEL_DS, but since that could be extremely dangerous if the protection is not present, it also raises SIGKILL for current, so that no matter what, the process will die. A successful test will be visible with a BUG(), like all the other LKDTM tests.
--- drivers/misc/lkdtm.h | 1 + drivers/misc/lkdtm_bugs.c | 11 +++++++++++ drivers/misc/lkdtm_core.c | 1 + 3 files changed, 13 insertions(+)
drivers/misc/lkdtm.h +1 -0
@@ -27,6 +27,7 @@ void lkdtm_REFCOUNT_ZERO_SUB(void);void lkdtm_REFCOUNT_ZERO_ADD (void );void lkdtm_CORRUPT_LIST_ADD (void );void lkdtm_CORRUPT_LIST_DEL (void ); +void lkdtm_CORRUPT_USER_DS (void );/* lkdtm_heap.c */ void lkdtm_OVERWRITE_ALLOCATION (void );
drivers/misc/lkdtm_bugs.c +11 -0
@@ -8,6 +8,8 @@#include <linux/list.h> #include <linux/refcount.h> #include <linux/sched.h> +#include <linux/sched/signal.h> +#include <linux/uaccess.h> struct lkdtm_list {struct list_head node;
@@ -279,3 +281,12 @@ void lkdtm_CORRUPT_LIST_DEL(void)else pr_err ("list_del() corruption not detected!\n" ); } + +void lkdtm_CORRUPT_USER_DS (void ) +{ +pr_info ("setting bad task size limit\n" ); +set_fs (KERNEL_DS ); + +/* Make sure we do not keep running with a KERNEL_DS! */ +force_sig (SIGKILL , current); +}
drivers/misc/lkdtm_core.c +1 -0
@@ -199,6 +199,7 @@ struct crashtype crashtypes[] = {CRASHTYPE (OVERFLOW ),CRASHTYPE (CORRUPT_LIST_ADD ),CRASHTYPE (CORRUPT_LIST_DEL ), +CRASHTYPE (CORRUPT_USER_DS ),CRASHTYPE (CORRUPT_STACK ),CRASHTYPE (UNALIGNED_LOAD_STORE_WRITE ), CRASHTYPE(OVERWRITE_ALLOCATION),
Signature · 6 lines
2.7.4 -- Kees Cook Pixel Security
Quoted 10 lines · Kees Cook
This adds
CORRUPT_USER_DSto check that theget_fs()test on syscall return (via__VERIFY_PRE_USERMODE_STATE) still seesUSER_DS. Since trying to deal with values other thanUSER_DSandKERNEL_DSacross all architectures in a safe way is not sensible, this setsKERNEL_DS, but since that could be extremely dangerous if the protection is not present, it also raises SIGKILL for current, so that no matter what, the process will die. A successful test will be visible with aBUG(), like all the other LKDTM tests.Signed-off-by Kees Cook <[email protected]>
Greg, can you add this to the drivers/misc tree when you get a moment?
Thanks!
-Kees
Quoted 63 lines
--- drivers/misc/lkdtm.h | 1 + drivers/misc/lkdtm_bugs.c | 11 +++++++++++ drivers/misc/lkdtm_core.c | 1 + 3 files changed, 13 insertions(+)drivers/misc/lkdtm.h +1
-0@@ -27,6 +27,7 @@ void lkdtm_REFCOUNT_ZERO_SUB(void);void lkdtm_REFCOUNT_ZERO_ADD (void );void lkdtm_CORRUPT_LIST_ADD (void );void lkdtm_CORRUPT_LIST_DEL (void ); +void lkdtm_CORRUPT_USER_DS (void );/* lkdtm_heap.c */ void lkdtm_OVERWRITE_ALLOCATION (void );drivers/misc/lkdtm_bugs.c +11
-0@@ -8,6 +8,8 @@#include <linux/list.h> #include <linux/refcount.h> #include <linux/sched.h> +#include <linux/sched/signal.h> +#include <linux/uaccess.h> struct lkdtm_list {struct list_head node;@@ -279,3 +281,12 @@ void lkdtm_CORRUPT_LIST_DEL(void)else pr_err ("list_del() corruption not detected!\n" ); } + +void lkdtm_CORRUPT_USER_DS (void ) +{ +pr_info ("setting bad task size limit\n" ); +set_fs (KERNEL_DS ); + +/* Make sure we do not keep running with a KERNEL_DS! */ +force_sig (SIGKILL , current); +}drivers/misc/lkdtm_core.c +1
-1@@ -199,6 +199,7 @@ struct crashtype crashtypes[] = {CRASHTYPE (OVERFLOW ),CRASHTYPE (CORRUPT_LIST_ADD ),CRASHTYPE (CORRUPT_LIST_DEL ), +CRASHTYPE (CORRUPT_USER_DS ),CRASHTYPE (CORRUPT_STACK ),CRASHTYPE (UNALIGNED_LOAD_STORE_WRITE ), CRASHTYPE(OVERWRITE_ALLOCATION), --2.7.4
--
Kees Cook
Pixel Security
Signature · 2 lines
Kees Cook Pixel Security