Add a flag preserve_creds that binfmt_misc can set to prevent credentials from being updated. This allows binfmt_misc to always call prepare_binprm. Allowing the credential computation logic to be consolidated. Not replacing the credentials with the interpreters credentials is safe because because an open file descriptor to the executable is passed to the interpreter. As the interpreter does not need to reopen the executable it is guaranteed to see the same file that exec sees.
Unified · Split
| @@ -218,19 +218,10 @@ static int load_misc_binary(struct linux_binprm *bprm) · 217 unmodified lines | |||
| 218 | goto error; | 218 | goto error; |
| 219 | 219 | ||
| 220 | bprm->file = interp_file; | 220 | bprm->file = interp_file; |
| 221 | if (fmt->flags & MISC_FMT_CREDENTIALS) { | 221 | if (fmt->flags & MISC_FMT_CREDENTIALS) |
| 222 | loff_t pos = 0; | 222 | bprm->preserve_creds = 1; |
| 223 | |||
| 224 | /* | ||
| 225 | * No need to call prepare_binprm(), it's already been | ||
| 226 | * done. bprm->buf is stale, update from interp_file. | ||
| 227 | */ | ||
| 228 | memset(bprm->buf, 0, BINPRM_BUF_SIZE); | ||
| 229 | retval = kernel_read(bprm->file, bprm->buf, BINPRM_BUF_SIZE, | ||
| 230 | &pos); | ||
| 231 | } else | ||
| 232 | retval = prepare_binprm(bprm); | ||
| 233 | 223 | ||
| 224 | retval = prepare_binprm(bprm); | ||
| 234 | if (retval < 0) | 225 | if (retval < 0) |
| 235 | goto error; | 226 | goto error; |
| 236 | 227 | ||
| @@ -1631,15 +1631,20 @@ static void bprm_fill_uid(struct linux_binprm *bprm) · 1630 unmodified lines | |||
| 1631 | */ | 1631 | */ |
| 1632 | int prepare_binprm(struct linux_binprm *bprm) | 1632 | int prepare_binprm(struct linux_binprm *bprm) |
| 1633 | { | 1633 | { |
| 1634 | int retval; | ||
| 1635 | loff_t pos = 0; | 1634 | loff_t pos = 0; |
| 1636 | 1635 | ||
| 1637 | /* Recompute parts of bprm->cred based on bprm->file */ | 1636 | /* Can the interpreter get to the executable without races? */ |
| 1638 | bprm->active_secureexec = 0; | 1637 | if (!bprm->preserve_creds) { |
| 1639 | bprm_fill_uid(bprm); | 1638 | int retval; |
| 1640 | retval = security_bprm_repopulate_creds(bprm); | 1639 | |
| 1641 | if (retval) | 1640 | /* Recompute parts of bprm->cred based on bprm->file */ |
| 1642 | return retval; | 1641 | bprm->active_secureexec = 0; |
| 1642 | bprm_fill_uid(bprm); | ||
| 1643 | retval = security_bprm_repopulate_creds(bprm); | ||
| 1644 | if (retval) | ||
| 1645 | return retval; | ||
| 1646 | } | ||
| 1647 | bprm->preserve_creds = 0; | ||
| 1643 | 1648 | ||
| 1644 | memset(bprm->buf, 0, BINPRM_BUF_SIZE); | 1649 | memset(bprm->buf, 0, BINPRM_BUF_SIZE); |
| 1645 | return kernel_read(bprm->file, bprm->buf, BINPRM_BUF_SIZE, &pos); | 1650 | return kernel_read(bprm->file, bprm->buf, BINPRM_BUF_SIZE, &pos); |
| @@ -26,6 +26,8 @@ struct linux_binprm { · 25 unmodified lines | |||
| 26 | unsigned long p; /* current top of mem */ | 26 | unsigned long p; /* current top of mem */ |
| 27 | unsigned long argmin; /* rlimit marker for copy_strings() */ | 27 | unsigned long argmin; /* rlimit marker for copy_strings() */ |
| 28 | unsigned int | 28 | unsigned int |
| 29 | /* It is safe to use the creds of a script (see binfmt_misc) */ | ||
| 30 | preserve_creds:1, | ||
| 29 | /* | 31 | /* |
| 30 | * True if most recent call to security_bprm_set_creds | 32 | * True if most recent call to security_bprm_set_creds |
| 31 | * resulted in elevated privileges. | 33 | * resulted in elevated privileges. |