| Message ID | 4F972329.60400@canonical.com |
|---|---|
| State | New |
| Headers | show |
Quoting Steve Conklin (sconklin@canonical.com): > This is a clean application of an upstream patch. The same fix has > already come from upstream stable for Oneiric and Precise. > > -Steve > > From c825bb675aea46fe858b58d1d31dccc6bb7c03c1 Mon Sep 17 00:00:00 2001 > From: Eric Paris <eparis@redhat.com> > Date: Tue, 17 Apr 2012 16:26:54 -0400 > Subject: [PATCH] fcaps: clear the same personality flags as suid when fcaps > are used > > CVE-2012-2123 > > BugLink: http://bugs.launchpad.net/bugs/987571 > > If a process increases permissions using fcaps all of the dangerous > personality flags which are cleared for suid apps should also be cleared. > Thus programs given priviledge with fcaps will continue to have address > space > randomization enabled even if the parent tried to disable it to make it > easier to attack. > > Signed-off-by: Eric Paris <eparis@redhat.com> > Reviewed-by: Serge Hallyn <serge.hallyn@canonical.com> > Signed-off-by: James Morris <james.l.morris@oracle.com> > > (cherry picked from commit d52fc5dde1) > Signed-off-by: Steve Conklin <sconklin@canonical.com> > --- > security/commoncap.c | 5 +++++ > 1 file changed, 5 insertions(+) > > diff --git a/security/commoncap.c b/security/commoncap.c > index 50be79b..5d5f64b 100644 > --- a/security/commoncap.c > +++ b/security/commoncap.c > @@ -512,6 +512,11 @@ int cap_bprm_set_creds(struct linux_binprm *bprm) > } > skip: > > + /* if we have fs caps, clear dangerous personality flags */ > + if (!cap_issubset(new->cap_permitted, old->cap_permitted)) > + bprm->per_clear |= PER_CLEAR_ON_SETID; Don't forget this also needed a follow-up patch to #include <linux/personality.h>. (upstream commit 51b79bee627d526199b2f6a6bef8ee0c0739b6d1) > + > + > /* Don't let someone trace a set[ug]id/setpcap binary with the revised > * credentials unless they have the appropriate permit > */ > -- > 1.7.9.5 > > -- > kernel-team mailing list > kernel-team@lists.ubuntu.com > https://lists.ubuntu.com/mailman/listinfo/kernel-team
diff --git a/security/commoncap.c b/security/commoncap.c index 50be79b..5d5f64b 100644 --- a/security/commoncap.c +++ b/security/commoncap.c @@ -512,6 +512,11 @@ int cap_bprm_set_creds(struct linux_binprm *bprm) } skip: + /* if we have fs caps, clear dangerous personality flags */ + if (!cap_issubset(new->cap_permitted, old->cap_permitted)) + bprm->per_clear |= PER_CLEAR_ON_SETID; + + /* Don't let someone trace a set[ug]id/setpcap binary with the revised * credentials unless they have the appropriate permit */