Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ccfef646 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge branch 'for-linus' of... 

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6:
  CRED: Fix SUID exec regression
parents ae1a25da 0bf2f3ae

fs/compat.c

+1 −1
Original line number Diff line number Diff line
@@ -1407,7 +1407,7 @@ int compat_do_execve(char * filename, 
	bprm->cred = prepare_exec_creds();

	if (!bprm->cred)

		goto out_unlock;

	check_unsafe_exec(bprm);

	check_unsafe_exec(bprm, current->files);



	file = open_exec(filename);

	retval = PTR_ERR(file);

fs/exec.c

+22 −6
Original line number Diff line number Diff line
@@ -1049,16 +1049,32 @@ EXPORT_SYMBOL(install_exec_creds); 
 * - the caller must hold current->cred_exec_mutex to protect against

 *   PTRACE_ATTACH

 */

void check_unsafe_exec(struct linux_binprm *bprm)

void check_unsafe_exec(struct linux_binprm *bprm, struct files_struct *files)

{

	struct task_struct *p = current;

	struct task_struct *p = current, *t;

	unsigned long flags;

	unsigned n_fs, n_files, n_sighand;



	bprm->unsafe = tracehook_unsafe_exec(p);



	if (atomic_read(&p->fs->count) > 1 ||

	    atomic_read(&p->files->count) > 1 ||

	    atomic_read(&p->sighand->count) > 1)

	n_fs = 1;

	n_files = 1;

	n_sighand = 1;

	lock_task_sighand(p, &flags);

	for (t = next_thread(p); t != p; t = next_thread(t)) {

		if (t->fs == p->fs)

			n_fs++;

		if (t->files == files)

			n_files++;

		n_sighand++;

	}



	if (atomic_read(&p->fs->count) > n_fs ||

	    atomic_read(&p->files->count) > n_files ||

	    atomic_read(&p->sighand->count) > n_sighand)

		bprm->unsafe |= LSM_UNSAFE_SHARE;



	unlock_task_sighand(p, &flags);

}



/*
@@ -1273,7 +1289,7 @@ int do_execve(char * filename, 
	bprm->cred = prepare_exec_creds();

	if (!bprm->cred)

		goto out_unlock;

	check_unsafe_exec(bprm);

	check_unsafe_exec(bprm, displaced);



	file = open_exec(filename);

	retval = PTR_ERR(file);

fs/internal.h

+1 −1
Original line number Diff line number Diff line
@@ -43,7 +43,7 @@ extern void __init chrdev_init(void); 
/*

 * exec.c

 */

extern void check_unsafe_exec(struct linux_binprm *);

extern void check_unsafe_exec(struct linux_binprm *, struct files_struct *);



/*

 * namespace.c