4.4-stable patches

added patches:
	keys-restrict-proc-keys-by-credentials-at-open-time.patch

diff --git a/queue-4.4/keys-restrict-proc-keys-by-credentials-at-open-time.patch b/queue-4.4/keys-restrict-proc-keys-by-credentials-at-open-time.patch
new file mode 100644 (file)
index 0000000..9d52de0
--- /dev/null
+++ b/queue-4.4/keys-restrict-proc-keys-by-credentials-at-open-time.patch
@@ -0,0 +1,52 @@
+From 4aa68e07d845562561f5e73c04aa521376e95252 Mon Sep 17 00:00:00 2001
+From: Eric Biggers <ebiggers@google.com>
+Date: Mon, 18 Sep 2017 11:38:29 -0700
+Subject: KEYS: restrict /proc/keys by credentials at open time
+
+From: Eric Biggers <ebiggers@google.com>
+
+commit 4aa68e07d845562561f5e73c04aa521376e95252 upstream.
+
+When checking for permission to view keys whilst reading from
+/proc/keys, we should use the credentials with which the /proc/keys file
+was opened.  This is because, in a classic type of exploit, it can be
+possible to bypass checks for the *current* credentials by passing the
+file descriptor to a suid program.
+
+Following commit 34dbbcdbf633 ("Make file credentials available to the
+seqfile interfaces") we can finally fix it.  So let's do it.
+
+Signed-off-by: Eric Biggers <ebiggers@google.com>
+Signed-off-by: David Howells <dhowells@redhat.com>
+Signed-off-by: David Howells <dhowells@redhat.com>
+Signed-off-by: Zubin Mithra <zsm@chromium.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ security/keys/proc.c |    8 ++------
+ 1 file changed, 2 insertions(+), 6 deletions(-)
+
+--- a/security/keys/proc.c
++++ b/security/keys/proc.c
+@@ -187,7 +187,7 @@ static int proc_keys_show(struct seq_fil
+ 
+       struct keyring_search_context ctx = {
+               .index_key              = key->index_key,
+-              .cred                   = current_cred(),
++              .cred                   = m->file->f_cred,
+               .match_data.cmp         = lookup_user_key_possessed,
+               .match_data.raw_data    = key,
+               .match_data.lookup_type = KEYRING_SEARCH_LOOKUP_DIRECT,
+@@ -207,11 +207,7 @@ static int proc_keys_show(struct seq_fil
+               }
+       }
+ 
+-      /* check whether the current task is allowed to view the key (assuming
+-       * non-possession)
+-       * - the caller holds a spinlock, and thus the RCU read lock, making our
+-       *   access to __current_cred() safe
+-       */
++      /* check whether the current task is allowed to view the key */
+       rc = key_task_permission(key_ref, ctx.cred, KEY_NEED_VIEW);
+       if (rc < 0)
+               return 0;

diff --git a/queue-4.4/series b/queue-4.4/series
index be313f1fbfad2139b24e41ed11ce2ae354f010fd..78416cf81713bddc7be98f78d1be7a3d184dcb54 100644 (file)
--- a/queue-4.4/series
+++ b/queue-4.4/series
@@ -122,3 +122,4 @@ netfilter-x_tables-enforce-nul-terminated-table-name-from-getsockopt-get_entries
 netfilter-nfnetlink_log-just-returns-error-for-unknown-command.patch
 netfilter-nfnetlink_acct-validate-nfacct_filter-parameters.patch
 netfilter-nf_conntrack_tcp-fix-stack-out-of-bounds-when-parsing-tcp-options.patch
+keys-restrict-proc-keys-by-credentials-at-open-time.patch