From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Thu, 14 Mar 2019 17:12:47 +0000 (-0700)
Subject: 4.4-stable patches
X-Git-Tag: v5.0.3~25
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=abdbca4736ca53444a2c8bfda18a81efbe5a2f60;p=thirdparty%2Fkernel%2Fstable-queue.git

4.4-stable patches

added patches:
	keys-restrict-proc-keys-by-credentials-at-open-time.patch
---

diff --git a/queue-4.4/keys-restrict-proc-keys-by-credentials-at-open-time.patch b/queue-4.4/keys-restrict-proc-keys-by-credentials-at-open-time.patch
new file mode 100644
index 00000000000..9d52de08acf
--- /dev/null
+++ b/queue-4.4/keys-restrict-proc-keys-by-credentials-at-open-time.patch
@@ -0,0 +1,52 @@
+From 4aa68e07d845562561f5e73c04aa521376e95252 Mon Sep 17 00:00:00 2001
+From: Eric Biggers <ebiggers@google.com>
+Date: Mon, 18 Sep 2017 11:38:29 -0700
+Subject: KEYS: restrict /proc/keys by credentials at open time
+
+From: Eric Biggers <ebiggers@google.com>
+
+commit 4aa68e07d845562561f5e73c04aa521376e95252 upstream.
+
+When checking for permission to view keys whilst reading from
+/proc/keys, we should use the credentials with which the /proc/keys file
+was opened.  This is because, in a classic type of exploit, it can be
+possible to bypass checks for the *current* credentials by passing the
+file descriptor to a suid program.
+
+Following commit 34dbbcdbf633 ("Make file credentials available to the
+seqfile interfaces") we can finally fix it.  So let's do it.
+
+Signed-off-by: Eric Biggers <ebiggers@google.com>
+Signed-off-by: David Howells <dhowells@redhat.com>
+Signed-off-by: David Howells <dhowells@redhat.com>
+Signed-off-by: Zubin Mithra <zsm@chromium.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ security/keys/proc.c |    8 ++------
+ 1 file changed, 2 insertions(+), 6 deletions(-)
+
+--- a/security/keys/proc.c
++++ b/security/keys/proc.c
+@@ -187,7 +187,7 @@ static int proc_keys_show(struct seq_fil
+ 
+ 	struct keyring_search_context ctx = {
+ 		.index_key		= key->index_key,
+-		.cred			= current_cred(),
++		.cred			= m->file->f_cred,
+ 		.match_data.cmp		= lookup_user_key_possessed,
+ 		.match_data.raw_data	= key,
+ 		.match_data.lookup_type	= KEYRING_SEARCH_LOOKUP_DIRECT,
+@@ -207,11 +207,7 @@ static int proc_keys_show(struct seq_fil
+ 		}
+ 	}
+ 
+-	/* check whether the current task is allowed to view the key (assuming
+-	 * non-possession)
+-	 * - the caller holds a spinlock, and thus the RCU read lock, making our
+-	 *   access to __current_cred() safe
+-	 */
++	/* check whether the current task is allowed to view the key */
+ 	rc = key_task_permission(key_ref, ctx.cred, KEY_NEED_VIEW);
+ 	if (rc < 0)
+ 		return 0;
diff --git a/queue-4.4/series b/queue-4.4/series
index be313f1fbfa..78416cf8171 100644
--- a/queue-4.4/series
+++ b/queue-4.4/series
@@ -122,3 +122,4 @@ netfilter-x_tables-enforce-nul-terminated-table-name-from-getsockopt-get_entries
 netfilter-nfnetlink_log-just-returns-error-for-unknown-command.patch
 netfilter-nfnetlink_acct-validate-nfacct_filter-parameters.patch
 netfilter-nf_conntrack_tcp-fix-stack-out-of-bounds-when-parsing-tcp-options.patch
+keys-restrict-proc-keys-by-credentials-at-open-time.patch