You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

Stephen Smalley 6cbaf7b943 selinux: fix off-by-one in setprocattr ... commit 0c461cb727 upstream. SELinux tries to support setting/clearing of /proc/pid/attr attributes from the shell by ignoring terminating newlines and treating an attribute value that begins with a NUL or newline as an attempt to clear the attribute. However, the test for clearing attributes has always been wrong; it has an off-by-one error, and this could further lead to reading past the end of the allocated buffer since commit bb646cdb12 ("proc_pid_attr_write(): switch to memdup_user()"). Fix the off-by-one error. Even with this fix, setting and clearing /proc/pid/attr attributes from the shell is not straightforward since the interface does not support multiple write() calls (so shells that write the value and newline separately will set and then immediately clear the attribute, requiring use of echo -n to set the attribute), whereas trying to use echo -n "" to clear the attribute causes the shell to skip the write() call altogether since POSIX says that a zero-length write causes no side effects. Thus, one must use echo -n to set and echo without -n to clear, as in the following example: $ echo -n unconfined_u:object_r:user_home_t:s0 > /proc/$$/attr/fscreate $ cat /proc/$$/attr/fscreate unconfined_u:object_r:user_home_t:s0 $ echo "" > /proc/$$/attr/fscreate $ cat /proc/$$/attr/fscreate Note the use of /proc/$$ rather than /proc/self, as otherwise the cat command will read its own attribute value, not that of the shell. There are no users of this facility to my knowledge; possibly we should just get rid of it. UPDATE: Upon further investigation it appears that a local process with the process:setfscreate permission can cause a kernel panic as a result of this bug. This patch fixes CVE-2017-2618. Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov> [PM: added the update about CVE-2017-2618 to the commit description] Signed-off-by: Paul Moore <paul@paul-moore.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: James Morris <james.l.morris@oracle.com>		6 years ago
..
include	selinux: drop SECURITY_SELINUX_POLICYDB_VERSION_MAX	7 years ago
ss	Merge branch 'printk-cleanups'	7 years ago
.gitignore	SELinux: add .gitignore files for dynamic classes	14 years ago
Kconfig	selinux: drop SECURITY_SELINUX_POLICYDB_VERSION_MAX	7 years ago
Makefile	selinux: use absolute path to include directory	7 years ago
avc.c	Merge branch 'next' of git://git.infradead.org/users/pcmoore/selinux into next	8 years ago
exports.c	selinux: sparse fix: include selinux.h in exports.c	12 years ago
hooks.c	selinux: fix off-by-one in setprocattr	6 years ago
netif.c	Merge commit 'v3.17' into next	8 years ago
netlabel.c	calipso: Add a label cache.	7 years ago
netlink.c	selinux: replace obsolete NLMSG_* with type safe nlmsg_*	10 years ago
netnode.c	selinux: remove unused variabled in the netport, netnode, and netif caches	9 years ago
netport.c	selinux: remove unused variabled in the netport, netnode, and netif caches	9 years ago
nlmsgtab.c	rtnetlink: add new RTM_GETSTATS message to dump link stats	7 years ago
selinuxfs.c	fs: Replace CURRENT_TIME with current_time() for inode timestamps	7 years ago
xfrm.c	netfilter: Remove spurios included of netfilter.h	8 years ago