Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 4e4a84f5 authored by Jann Horn's avatar Jann Horn Committed by Mark Salyzyn
Browse files

UPSTREAM: seccomp: always propagate NO_NEW_PRIVS on tsync 



Before this patch, a process with some permissive seccomp filter
that was applied by root without NO_NEW_PRIVS was able to add
more filters to itself without setting NO_NEW_PRIVS by setting
the new filter from a throwaway thread with NO_NEW_PRIVS.

Signed-off-by: default avatarJann Horn <jann@thejh.net>
Cc: stable@vger.kernel.org
Signed-off-by: default avatarKees Cook <keescook@chromium.org>

Bug: 36656103
(cherry-picked from commit 103502a35cfce0710909da874f092cb44823ca03)
Signed-off-by: default avatarPaul Lawrence <paullawrence@google.com>
Change-Id: I5abd7daab9172f1dfd53e11706b7c7f331f2f4f1
parent 916e8844

kernel/seccomp.c

+11 −11
Original line number Diff line number Diff line
@@ -317,13 +317,7 @@ static inline void seccomp_sync_threads(void) 
		put_seccomp_filter(thread);

		smp_store_release(&thread->seccomp.filter,

				  caller->seccomp.filter);

		/*

		 * Opt the other thread into seccomp if needed.

		 * As threads are considered to be trust-realm

		 * equivalent (see ptrace_may_access), it is safe to

		 * allow one thread to transition the other.

		 */

		if (thread->seccomp.mode == SECCOMP_MODE_DISABLED) {



		/*

		 * Don't let an unprivileged task work around

		 * the no_new_privs restriction by creating
@@ -333,10 +327,16 @@ static inline void seccomp_sync_threads(void) 
		if (task_no_new_privs(caller))

			task_set_no_new_privs(thread);



		/*

		 * Opt the other thread into seccomp if needed.

		 * As threads are considered to be trust-realm

		 * equivalent (see ptrace_may_access), it is safe to

		 * allow one thread to transition the other.

		 */

		if (thread->seccomp.mode == SECCOMP_MODE_DISABLED)

			seccomp_assign_mode(thread, SECCOMP_MODE_FILTER);

	}

}

}



/**

 * seccomp_prepare_filter: Prepares a seccomp filter for use.