From patchwork Tue May 4 16:45:40 2010 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andy Whitcroft X-Patchwork-Id: 51631 X-Patchwork-Delegate: stefan.bader@canonical.com Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from chlorine.canonical.com (chlorine.canonical.com [91.189.94.204]) by ozlabs.org (Postfix) with ESMTP id 993DFB7D51 for ; Wed, 5 May 2010 02:45:52 +1000 (EST) Received: from localhost ([127.0.0.1] helo=chlorine.canonical.com) by chlorine.canonical.com with esmtp (Exim 4.69) (envelope-from ) id 1O9LFk-0006Ol-5b; Tue, 04 May 2010 17:45:48 +0100 Received: from adelie.canonical.com ([91.189.90.139]) by chlorine.canonical.com with esmtp (Exim 4.69) (envelope-from ) id 1O9LFf-0006M6-Tv for kernel-team@lists.ubuntu.com; Tue, 04 May 2010 17:45:43 +0100 Received: from hutte.canonical.com ([91.189.90.181]) by adelie.canonical.com with esmtp (Exim 4.69 #1 (Debian)) id 1O9LFe-0004VM-9C for ; Tue, 04 May 2010 17:45:42 +0100 Received: from 79-70-103-73.dynamic.dsl.as9105.com ([79.70.103.73] helo=localhost.localdomain) by hutte.canonical.com with esmtpsa (TLS-1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.69) (envelope-from ) id 1O9LFe-0006Zz-5K for kernel-team@lists.ubuntu.com; Tue, 04 May 2010 17:45:42 +0100 From: Andy Whitcroft To: kernel-team@lists.ubuntu.com Subject: [PATCH 1/1] UBUNTU: SAUCE: mmap_min_addr check CAP_SYS_RAWIO only for write Date: Tue, 4 May 2010 17:45:40 +0100 Message-Id: <1272991540-2253-2-git-send-email-apw@canonical.com> X-Mailer: git-send-email 1.7.0.4 In-Reply-To: <1272991540-2253-1-git-send-email-apw@canonical.com> References: <1272991540-2253-1-git-send-email-apw@canonical.com> X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.9 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Sender: kernel-team-bounces@lists.ubuntu.com Errors-To: kernel-team-bounces@lists.ubuntu.com From: Kees Cook Redirecting directly to lsm, here's the patch discussed on lkml: http://lkml.org/lkml/2010/4/22/219 The mmap_min_addr value is useful information for an admin to see without being root ("is my system vulnerable to kernel NULL pointer attacks?") and its setting is trivially easy for an attacker to determine by calling mmap() in PAGE_SIZE increments starting at 0, so trying to keep it private has no value. Only require CAP_SYS_RAWIO if changing the value, not reading it. Comment from Serge : Me, I like to write my passwords with light blue pen on dark blue paper, pasted on my window - if you're going to get my password, you're gonna get a headache. BugLink: http://bugs.launchpad.net/bugs/568844 Signed-off-by: Kees Cook Acked-by: Serge Hallyn Signed-off-by: James Morris Signed-off-by: Andy Whitcroft --- security/min_addr.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/security/min_addr.c b/security/min_addr.c index fc43c9d..d9f9425 100644 --- a/security/min_addr.c +++ b/security/min_addr.c @@ -33,7 +33,7 @@ int mmap_min_addr_handler(struct ctl_table *table, int write, { int ret; - if (!capable(CAP_SYS_RAWIO)) + if (write && !capable(CAP_SYS_RAWIO)) return -EPERM; ret = proc_doulongvec_minmax(table, write, buffer, lenp, ppos);