From: Paul Moore <paul@paul-moore.com>
To: "chengjian (D)" <cj.chengjian@huawei.com>
Cc: Kees Cook <keescook@chromium.org>,
Oleg Nesterov <oleg@redhat.com>,
Casey Schaufler <casey@schaufler-ca.com>,
NeilBrown <neilb@suse.com>,
Anna Schumaker <Anna.Schumaker@netapp.com>,
"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
Al Viro <viro@zeniv.linux.org.uk>,
"Xiexiuqi (Xie XiuQi)" <xiexiuqi@huawei.com>,
Li Bin <huawei.libin@huawei.com>, Jason Yan <yanaijie@huawei.com>,
Peter Zijlstra <peterz@infradead.org>,
Ingo Molnar <mingo@redhat.com>,
Linux Security Module list
<linux-security-module@vger.kernel.org>,
SELinux <selinux@vger.kernel.org>,
Yang Yingliang <yangyingliang@huawei.com>
Subject: Re: kernel BUG at kernel/cred.c:434!
Date: Wed, 17 Apr 2019 10:30:08 -0400 [thread overview]
Message-ID: <CAHC9VhSpnSpYLLOcFUFLM=UU8tUTLAzJYb2NgdbN-nLPrh=55g@mail.gmail.com> (raw)
In-Reply-To: <fa325d38-db66-0ae7-0a6c-75934a9b0653@huawei.com>
On Tue, Apr 16, 2019 at 10:46 AM chengjian (D) <cj.chengjian@huawei.com> wrote:
> On 2019/4/16 11:40, Kees Cook wrote:
> > On Mon, Apr 15, 2019 at 11:20 AM Paul Moore <paul@paul-moore.com> wrote:
> >> On Mon, Apr 15, 2019 at 11:05 AM Oleg Nesterov <oleg@redhat.com> wrote:
> >>> On 04/15, Paul Moore wrote:
> >>>> On Mon, Apr 15, 2019 at 9:43 AM Oleg Nesterov <oleg@redhat.com> wrote:
> >>>>> Well, acct("/proc/self/attr/current") doesn't look like a good idea, but I do
> >>>>> not know where should we put the additional check... And probably
> >>>>> "echo /proc/self/attr/current > /proc/sys/kernel/core_pattern" can hit the
> >>>>> same problem, do_coredump() does override_creds() too.
> >>>>>
> >>>>> May be just add
> >>>>>
> >>>>> if (current->cred != current->real_cred)
> >>>>> return -EACCES;
> >>>>>
> >>>>> into proc_pid_attr_write(), I dunno.
> >>>> Is the problem that do_acct_process() is calling override_creds() and
> >>>> the returned/old credentials are being freed before do_acct_process()
> >>>> can reinstall the creds via revert_creds()? Presumably because the
> >>>> process accounting is causing the credentials to be replaced?
> >>> Afaics, the problem is that do_acct_process() does override_creds() and
> >>> then __kernel_write(). Which calls proc_pid_attr_write(), which in turn calls
> >>> selinux_setprocattr(), which does another prepare_creds() + commit_creds();
> >>> and commit_creds() hits
> >>>
> >>> BUG_ON(task->cred != old);
> >> Gotcha. In the process of looking at the backtrace I forgot about the
> >> BUG_ON() at the top of the oops message.
> >>
> >> I wonder what terrible things would happen if we changed the BUG_ON()
> >> in commit_creds to simple returning an error an error code to the
> >> caller. There is a warning/requirement in commit_creds() function
> >> header comment that it should always return 0.
> > Would callers be expected to call abort_creds() on failure? There are
> > a number of places where it'd need fixing up. And would likely be best
> > with a __must_check marking.
> >
> > It seems like avoiding the pathological case might be simpler?
>
> Yeah, Avoiding this pathological case is a better solution.
No arguments that this is particularly messed up scenario, I'm just
trying to arrive at a solution that isn't too ugly.
> From: Yang Yingliang <yangyingliang@huawei.com>
> Date: Sat, 13 Apr 2019 21:56:01 +0800
> Subject: [PATCH] fix cred bug_on
>
> Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
> ---
> kernel/acct.c | 3 ++-
> kernel/cred.c | 6 ++++++
> security/selinux/hooks.c | 2 ++
> 3 files changed, 10 insertions(+), 1 deletion(-)
>
> diff --git a/kernel/acct.c b/kernel/acct.c
> index addf7732fb56..f2065f899eee 100644
> --- a/kernel/acct.c
> +++ b/kernel/acct.c
> @@ -522,7 +522,8 @@ static void do_acct_process(struct bsd_acct_struct
> *acct)
> }
> out:
> current->signal->rlim[RLIMIT_FSIZE].rlim_cur = flim;
> - revert_creds(orig_cred);
> + if (orig_cred == current->real_cred) // [2]
> + revert_creds(orig_cred);
> }
>
> /**
> diff --git a/kernel/cred.c b/kernel/cred.c
> index ecf03657e71c..c4d5ba92fb9b 100644
> --- a/kernel/cred.c
> +++ b/kernel/cred.c
> @@ -522,6 +522,9 @@ const struct cred *override_creds(const struct cred
> *new)
> {
> const struct cred *old = current->cred;
>
> + if (old == new) // [3]
> + return old;
> +
> kdebug("override_creds(%p{%d,%d})", new,
> atomic_read(&new->usage),
> read_cred_subscribers(new));
> @@ -551,6 +554,9 @@ void revert_creds(const struct cred *old)
> {
> const struct cred *override = current->cred;
>
> + if (override == old) // [3]
> + return;
> +
> kdebug("revert_creds(%p{%d,%d})", old,
> atomic_read(&old->usage),
> read_cred_subscribers(old));
> diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
> index b5017beb4ef7..bc8108e4e90f 100644
> --- a/security/selinux/hooks.c
> +++ b/security/selinux/hooks.c
> @@ -6590,6 +6590,8 @@ static int selinux_setprocattr(const char *name,
> void *value, size_t size)
> goto abort_change;
> }
>
> + if (current->cred != current->real_cred) // [1]
> + revert_creds(current->real_cred);
> commit_creds(new);
> return size;
Doing the revert only to then commit the creds seems really ugly to
me. I'm tempted to simply return an error in selinux_setprocattr() if
the task's credentials are not the same as its real_cred; if we do
that I believe we should resolve this problem. The accounting write
to the SELinux file in /proc would fail of course, but I think we can
all consider that as a positive side-effect.
While I don't think this should have a negative impact on anything
else, I haven't convinced myself of that just yet.
--
paul moore
www.paul-moore.com
next prev parent reply other threads:[~2019-04-17 14:30 UTC|newest]
Thread overview: 27+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <6e4428ca-3da1-a033-08f7-a51e57503989@huawei.com>
2019-04-12 15:28 ` kernel BUG at kernel/cred.c:434! Casey Schaufler
2019-04-15 13:43 ` Oleg Nesterov
2019-04-15 14:48 ` Paul Moore
2019-04-15 15:05 ` Oleg Nesterov
2019-04-15 16:20 ` Paul Moore
2019-04-16 3:40 ` Kees Cook
2019-04-16 14:46 ` chengjian (D)
2019-04-17 14:30 ` Paul Moore [this message]
2019-04-17 14:57 ` Oleg Nesterov
2019-04-17 15:39 ` Casey Schaufler
2019-04-17 15:40 ` Paul Moore
2019-04-17 16:27 ` Oleg Nesterov
2019-04-17 16:42 ` Casey Schaufler
2019-04-18 13:39 ` Stephen Smalley
2019-04-17 23:39 ` Paul Moore
2019-04-18 0:17 ` John Johansen
2019-04-18 0:24 ` Casey Schaufler
2019-04-18 2:49 ` Yang Yingliang
2019-04-19 2:04 ` Paul Moore
2019-04-19 2:34 ` Yang Yingliang
2019-04-19 13:24 ` Paul Moore
2019-04-19 14:34 ` Yang Yingliang
2019-04-19 16:13 ` Paul Moore
2019-04-20 7:38 ` Yang Yingliang
2019-04-22 19:48 ` Paul Moore
2019-04-23 4:08 ` Yang Yingliang
2019-04-23 20:18 ` Paul Moore
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CAHC9VhSpnSpYLLOcFUFLM=UU8tUTLAzJYb2NgdbN-nLPrh=55g@mail.gmail.com' \
--to=paul@paul-moore.com \
--cc=Anna.Schumaker@netapp.com \
--cc=casey@schaufler-ca.com \
--cc=cj.chengjian@huawei.com \
--cc=huawei.libin@huawei.com \
--cc=keescook@chromium.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=mingo@redhat.com \
--cc=neilb@suse.com \
--cc=oleg@redhat.com \
--cc=peterz@infradead.org \
--cc=selinux@vger.kernel.org \
--cc=viro@zeniv.linux.org.uk \
--cc=xiexiuqi@huawei.com \
--cc=yanaijie@huawei.com \
--cc=yangyingliang@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).