• Jann Horn's avatar
    aio: mark AIO pseudo-fs noexec · 0d9529e1
    Jann Horn authored
    commit 22f6b4d3 upstream.
    
    This ensures that do_mmap() won't implicitly make AIO memory mappings
    executable if the READ_IMPLIES_EXEC personality flag is set.  Such
    behavior is problematic because the security_mmap_file LSM hook doesn't
    catch this case, potentially permitting an attacker to bypass a W^X
    policy enforced by SELinux.
    
    I have tested the patch on my machine.
    
    To test the behavior, compile and run this:
    
        #define _GNU_SOURCE
        #include <unistd.h>
        #include <sys/personality.h>
        #include <linux/aio_abi.h>
        #include <err.h>
        #include <stdlib.h>
        #include <stdio.h>
        #include <sys/syscall.h>
    
        int main(void) {
            personality(READ_IMPLIES_EXEC);
            aio_context_t ctx = 0;
            if (syscall(__NR_io_setup, 1, &ctx))
                err(1, "io_setup");
    
            char cmd[1000];
            sprintf(cmd, "cat /proc/%d/maps | grep -F '/[aio]'",
                (int)getpid());
            system(cmd);
            return 0;
        }
    
    In the output, "rw-s" is good, "rwxs" is bad.
    Signed-off-by: default avatarJann Horn <jann@thejh.net>
    Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
    0d9529e1
aio.c 43.1 KB