Re: Require mmap handler for a.out executables

From: Eugene Teo
Date: Thu Jul 27 2006 - 13:19:50 EST


Christoph Hellwig wrote:
>> diff --git a/fs/binfmt_aout.c b/fs/binfmt_aout.c
>> index f312103..5638acf 100644
>> --- a/fs/binfmt_aout.c
>> +++ b/fs/binfmt_aout.c
>> @@ -278,6 +278,9 @@ static int load_aout_binary(struct linux
>> return -ENOEXEC;
>> }
>>
>> + if (!bprm->file->f_op || !bprm->file->f_op->mmap)
>> + return -ENOEXEC;
>> +
>
> These checks need a big comment explanining why they are there, else people
> will remove them again by accident.

Here's a resend.

Like what Marcel wrote, Andrew, please include this patch in -mm for testing.
Thanks.

Eugene
--

[PATCH] Require mmap handler for a.out executables

Files supported by fs/proc/base.c, i.e. /proc/<pid>/*, are not capable
of meeting the validity checks in ELF load_elf_*() handling because they
have no mmap handler which is required by ELF. In order to stop a.out
executables being used as part of an exploit attack against /proc-related
vulnerabilities, we make a.out executables depend on ->mmap() existing.

Signed-off-by: Eugene Teo <eteo@xxxxxxxxxx>
Signed-off-by: Marcel Holtmann <marcel@xxxxxxxxxxxx>

diff --git a/fs/binfmt_aout.c b/fs/binfmt_aout.c
index f312103..2042dfa 100644
--- a/fs/binfmt_aout.c
+++ b/fs/binfmt_aout.c
@@ -278,6 +278,12 @@ static int load_aout_binary(struct linux
return -ENOEXEC;
}

+ /* Requires a mmap handler. This prevents people from using a.out
+ * as part of an exploit attack against /proc-related vulnerabilities.
+ */
+ if (!bprm->file->f_op || !bprm->file->f_op->mmap)
+ return -ENOEXEC;
+
fd_offset = N_TXTOFF(ex);

/* Check initial limits. This avoids letting people circumvent
@@ -476,6 +482,12 @@ static int load_aout_library(struct file
goto out;
}

+ /* Requires a mmap handler. This prevents people from using a.out
+ * as part of an exploit attack against /proc-related vulnerabilities.
+ */
+ if (!file->f_op || !file->f_op->mmap)
+ goto out;
+
if (N_FLAGS(ex))
goto out;

--
eteo redhat.com ph: +65 6490 4142 http://www.kernel.org/~eugeneteo
gpg fingerprint: 47B9 90F6 AE4A 9C51 37E0 D6E1 EA84 C6A2 58DF 8823
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/