• Yoav Zach's avatar
    [PATCH] binfmt_misc: improve calculation of interpreter's credentials · c407c033
    Yoav Zach authored
    This patch allows for misc binaries to run with credentials and security
    token that are calculated according to the binaries, and not according to the
    interpreter, which is the legacy behavior of binfmt_misc.
    
    The way it is done is by calling prepare_binprm, which is where these
    attributes are calculated, before switching the 'file' field in the bprm from
    the binary to the interpreter.
    
    This feature should be used with care, since the interpreter will have root
    permissions when running a setuid binary owned by root.
    
    Please note -
    
    - Only root can register an interpreter with binfmt_misc.  The feature is
      documented and the administrator is advised to handle it with care
    
    - The new feature is enabled only with a special flag in the registration
      string.  When this flag is not specified the current behavior of
      binfmt_misc is kept
    
    - This is the only 'right' way for an interpreter to know the correct
      AT_SECURE value for the interpreted binary
    
    
    From: Chris Wright <chrisw@osdl.org>
    
      This patchset looks OK, except for one problem.  It installs the fd (which
      could've been unreadable) without unsharing the ->files.  So someone can use
      this to read unreadable yet executable files.  Here's a patch which fixes
      that up.  I added one bit that's commented out because I'm not positive if a
      final steal_locks() is needed.
    
      I did a fair amount of rearranging to simplify the error conditions
      relative to the fd_install(), and unshare_files().
    
    From: Chris Wright <chrisw@osdl.org>
    
      I found that the intel patchset (and mine as well) leaked i_writecount on
      the original executed file.  In addition, I verified that the steal_locks()
      bit is indeed needed.
    Signed-off-by: default avatarAndrew Morton <akpm@osdl.org>
    Signed-off-by: default avatarLinus Torvalds <torvalds@osdl.org>
    c407c033
binfmt_misc.c 15.7 KB