vfs: Commit to never having exectuables on proc and sysfs.

Today proc and sysfs do not contain any executable files.  Several
applications today mount proc or sysfs without noexec and nosuid and
then depend on there being no exectuables files on proc or sysfs.
Having any executable files show on proc or sysfs would cause
a user space visible regression, and most likely security problems.

Therefore commit to never allowing executables on proc and sysfs by
adding a new flag to mark them as filesystems without executables and
enforce that flag.

Test the flag where MNT_NOEXEC is tested today, so that the only user
visible effect will be that exectuables will be treated as if the
execute bit is cleared.

The filesystems proc and sysfs do not currently incoporate any
executable files so this does not result in any user visible effects.

This makes it unnecessary to vet changes to proc and sysfs tightly for
adding exectuable files or changes to chattr that would modify
existing files, as no matter what the individual file say they will
not be treated as exectuable files by the vfs.

Not having to vet changes to closely is important as without this we
are only one proc_create call (or another goof up in the
implementation of notify_change) from having problematic executables
on proc.  Those mistakes are all too easy to make and would create
a situation where there are security issues or the assumptions of
some program having to be broken (and cause userspace regressions).

Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>

diff --git a/fs/exec.c b/fs/exec.c
index 1977c2a553aca711ba145d1670ea9a84fd45ea84..b06623a9347f4f206fb466c80574ec4bdd7d13fa 100644 (file)
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -98,6 +98,12 @@ static inline void put_binfmt(struct linux_binfmt * fmt)
        module_put(fmt->module);
 }
 
+bool path_noexec(const struct path *path)
+{
+       return (path->mnt->mnt_flags & MNT_NOEXEC) ||
+              (path->mnt->mnt_sb->s_iflags & SB_I_NOEXEC);
+}
+
 #ifdef CONFIG_USELIB
 /*
  * Note that a shared library must be both readable and executable due to
@@ -132,7 +138,7 @@ SYSCALL_DEFINE1(uselib, const char __user *, library)
                goto exit;
 
        error = -EACCES;
-       if (file->f_path.mnt->mnt_flags & MNT_NOEXEC)
+       if (path_noexec(&file->f_path))
                goto exit;
 
        fsnotify_open(file);
@@ -777,7 +783,7 @@ static struct file *do_open_execat(int fd, struct filename *name, int flags)
        if (!S_ISREG(file_inode(file)->i_mode))
                goto exit;
 
-       if (file->f_path.mnt->mnt_flags & MNT_NOEXEC)
+       if (path_noexec(&file->f_path))
                goto exit;
 
        err = deny_write_access(file);

diff --git a/fs/open.c b/fs/open.c
index e33dab287fa00a3d1d657e4b2d23c1f74529ae72..b6f1e96a7c0b331b3e5a5d9bb4c014c5c9edc54b 100644 (file)
--- a/fs/open.c
+++ b/fs/open.c
@@ -377,7 +377,7 @@ retry:
                 * with the "noexec" flag.
                 */
                res = -EACCES;
-               if (path.mnt->mnt_flags & MNT_NOEXEC)
+               if (path_noexec(&path))
                        goto out_path_release;
        }
 

diff --git a/fs/proc/root.c b/fs/proc/root.c
index 68feb0f70e6358f83f5a5281bf3c64d16cad2015..361ab4ee42fc3632232f4bc6eaef54a12f6b47e6 100644 (file)
--- a/fs/proc/root.c
+++ b/fs/proc/root.c
@@ -134,6 +134,8 @@ static struct dentry *proc_mount(struct file_system_type *fs_type,
                }
 
                sb->s_flags |= MS_ACTIVE;
+               /* User space would break if executables appear on proc */
+               sb->s_iflags |= SB_I_NOEXEC;
        }
 
        return dget(sb->s_root);

diff --git a/fs/sysfs/mount.c b/fs/sysfs/mount.c
index 1c6ac6fcee9fb15c869ef80fc5947ba9117d77ea..f3db82071cfbd5997bdb1393097e755ae730ea96 100644 (file)
--- a/fs/sysfs/mount.c
+++ b/fs/sysfs/mount.c
@@ -40,6 +40,10 @@ static struct dentry *sysfs_mount(struct file_system_type *fs_type,
                                SYSFS_MAGIC, &new_sb, ns);
        if (IS_ERR(root) || !new_sb)
                kobj_ns_drop(KOBJ_NS_TYPE_NET, ns);
+       else if (new_sb)
+               /* Userspace would break if executables appear on sysfs */
+               root->d_sb->s_iflags |= SB_I_NOEXEC;
+
        return root;
 }
 

diff --git a/include/linux/fs.h b/include/linux/fs.h
index a0653e560c2679a2eea870035a55cd3282e47894..42912f8d286eb5c77fef0c39c550320e8ad1e736 100644 (file)
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -1244,6 +1244,7 @@ struct mm_struct;
 
 /* sb->s_iflags */
 #define SB_I_CGROUPWB  0x00000001      /* cgroup-aware writeback enabled */
+#define SB_I_NOEXEC    0x00000002      /* Ignore executables on this fs */
 
 /* Possible states of 'frozen' field */
 enum {
@@ -3030,4 +3031,6 @@ static inline bool dir_relax(struct inode *inode)
        return !IS_DEADDIR(inode);
 }
 
+extern bool path_noexec(const struct path *path);
+
 #endif /* _LINUX_FS_H */

diff --git a/kernel/sys.c b/kernel/sys.c
index 259fda25eb6bac6dcbcfe788590a14ebb63e87f2..fa2f2f671a5cadb271367b13f8b119a21c8bf6b7 100644 (file)
--- a/kernel/sys.c
+++ b/kernel/sys.c
@@ -1668,8 +1668,7 @@ static int prctl_set_mm_exe_file(struct mm_struct *mm, unsigned int fd)
         * overall picture.
         */
        err = -EACCES;
-       if (!S_ISREG(inode->i_mode)     ||
-           exe.file->f_path.mnt->mnt_flags & MNT_NOEXEC)
+       if (!S_ISREG(inode->i_mode) || path_noexec(&exe.file->f_path))
                goto exit;
 
        err = inode_permission(inode, MAY_EXEC);

diff --git a/mm/mmap.c b/mm/mmap.c
index aa632ade2be797a9cc4f7a80e37884bc4e14745a..f126923ce683c6969a9ce2498bcd481d90d39b8e 100644 (file)
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -1268,7 +1268,7 @@ unsigned long do_mmap_pgoff(struct file *file, unsigned long addr,
         *  mounted, in which case we dont add PROT_EXEC.)
         */
        if ((prot & PROT_READ) && (current->personality & READ_IMPLIES_EXEC))
-               if (!(file && (file->f_path.mnt->mnt_flags & MNT_NOEXEC)))
+               if (!(file && path_noexec(&file->f_path)))
                        prot |= PROT_EXEC;
 
        if (!(flags & MAP_FIXED))
@@ -1337,7 +1337,7 @@ unsigned long do_mmap_pgoff(struct file *file, unsigned long addr,
                case MAP_PRIVATE:
                        if (!(file->f_mode & FMODE_READ))
                                return -EACCES;
-                       if (file->f_path.mnt->mnt_flags & MNT_NOEXEC) {
+                       if (path_noexec(&file->f_path)) {
                                if (vm_flags & VM_EXEC)
                                        return -EPERM;
                                vm_flags &= ~VM_MAYEXEC;

diff --git a/mm/nommu.c b/mm/nommu.c
index 58ea3643b9e9968a723f498d7df55b34c51a179e..ce17abf087ff5917c5d51177ec4a331a240ed746 100644 (file)
--- a/mm/nommu.c
+++ b/mm/nommu.c
@@ -1035,7 +1035,7 @@ static int validate_mmap_request(struct file *file,
 
                /* handle executable mappings and implied executable
                 * mappings */
-               if (file->f_path.mnt->mnt_flags & MNT_NOEXEC) {
+               if (path_noexec(&file->f_path)) {
                        if (prot & PROT_EXEC)
                                return -EPERM;
                } else if ((prot & PROT_READ) && !(prot & PROT_EXEC)) {

diff --git a/security/security.c b/security/security.c
index 595fffab48b0a27077efa75ec9dd64e6983ae2d9..062f3c997fdc32a585c0ac02f72a108fee094f53 100644 (file)
--- a/security/security.c
+++ b/security/security.c
@@ -776,7 +776,7 @@ static inline unsigned long mmap_prot(struct file *file, unsigned long prot)
         * ditto if it's not on noexec mount, except that on !MMU we need
         * NOMMU_MAP_EXEC (== VM_MAYEXEC) in this case
         */
-       if (!(file->f_path.mnt->mnt_flags & MNT_NOEXEC)) {
+       if (!path_noexec(&file->f_path)) {
 #ifndef CONFIG_MMU
                if (file->f_op->mmap_capabilities) {
                        unsigned caps = file->f_op->mmap_capabilities(file);