| From foo@baz Sun Jun 17 12:07:33 CEST 2018 |
| From: Alexey Dobriyan <adobriyan@gmail.com> |
| Date: Fri, 20 Apr 2018 14:56:03 -0700 |
| Subject: proc: revalidate kernel thread inodes to root:root |
| |
| From: Alexey Dobriyan <adobriyan@gmail.com> |
| |
| [ Upstream commit 2e0ad552f5f8cd0fda02bc45fcd2b89821c62fd1 ] |
| |
| task_dump_owner() has the following code: |
| |
| mm = task->mm; |
| if (mm) { |
| if (get_dumpable(mm) != SUID_DUMP_USER) { |
| uid = ... |
| } |
| } |
| |
| Check for ->mm is buggy -- kernel thread might be borrowing mm |
| and inode will go to some random uid:gid pair. |
| |
| Link: http://lkml.kernel.org/r/20180412220109.GA20978@avx2 |
| Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com> |
| Cc: "Eric W. Biederman" <ebiederm@xmission.com> |
| Signed-off-by: Andrew Morton <akpm@linux-foundation.org> |
| Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> |
| Signed-off-by: Sasha Levin <alexander.levin@microsoft.com> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| --- |
| fs/proc/base.c | 6 ++++++ |
| 1 file changed, 6 insertions(+) |
| |
| --- a/fs/proc/base.c |
| +++ b/fs/proc/base.c |
| @@ -1693,6 +1693,12 @@ void task_dump_owner(struct task_struct |
| kuid_t uid; |
| kgid_t gid; |
| |
| + if (unlikely(task->flags & PF_KTHREAD)) { |
| + *ruid = GLOBAL_ROOT_UID; |
| + *rgid = GLOBAL_ROOT_GID; |
| + return; |
| + } |
| + |
| /* Default to the tasks effective ownership */ |
| rcu_read_lock(); |
| cred = __task_cred(task); |