linux-toradex.git/Documentation/sysctl/kernel.txt, branch v3.4.73

vsprintf: check real user/group id for %pK

2013-12-04T18:50:14+00:00

commit 312b4e226951f707e120b95b118cbc14f3d162b2 upstream.

Some setuid binaries will allow reading of files which have read
permission by the real user id.  This is problematic with files which
use %pK because the file access permission is checked at open() time,
but the kptr_restrict setting is checked at read() time.  If a setuid
binary opens a %pK file as an unprivileged user, and then elevates
permissions before reading the file, then kernel pointer values may be
leaked.

This happens for example with the setuid pppd application on Ubuntu 12.04:

  $ head -1 /proc/kallsyms
  00000000 T startup_32

  $ pppd file /proc/kallsyms
  pppd: In file /proc/kallsyms: unrecognized option 'c1000000'

This will only leak the pointer value from the first line, but other
setuid binaries may leak more information.

Fix this by adding a check that in addition to the current process having
CAP_SYSLOG, that effective user and group ids are equal to the real ids.
If a setuid binary reads the contents of a file which uses %pK then the
pointer values will be printed as NULL if the real user is unprivileged.

Update the sysctl documentation to reflect the changes, and also correct
the documentation to state the kptr_restrict=0 is the default.

This is a only temporary solution to the issue.  The correct solution is
to do the permission check at open() time on files, and to replace %pK
with a function which checks the open() time permission.  %pK uses in
printk should be removed since no sane permission check can be done, and
instead protected by using dmesg_restrict.

Signed-off-by: Ryan Mallon 
Cc: Kees Cook 
Cc: Alexander Viro 
Cc: Joe Perches 
Cc: "Eric W. Biederman" 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
Signed-off-by: Greg Kroah-Hartman

Documentation: add missing tainted bits to Documentation/sysctl/kernel.txt

2012-02-07T00:29:19+00:00

Two of the bits in the tainted flag are not documented.

Signed-off-by: Larry Finger 
Signed-off-by: Randy Dunlap 
Signed-off-by: Linus Torvalds

sysctl: add the kernel.ns_last_pid control

2012-01-13T04:13:11+00:00

The sysctl works on the current task's pid namespace, getting and setting
its last_pid field.

Writing is allowed for CAP_SYS_ADMIN-capable tasks thus making it possible
to create a task with desired pid value.  This ability is required badly
for the checkpoint/restore in userspace.

This approach suits all the parties for now.

Signed-off-by: Pavel Emelyanov 
Acked-by: Tejun Heo 
Cc: Oleg Nesterov 
Cc: Cyrill Gorcunov 
Cc: "Eric W. Biederman" 
Cc: Serge Hallyn 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

x86: Panic on detection of stack overflow

2011-12-05T10:37:47+00:00

Currently, messages are just output on the detection of stack
overflow, which is not sufficient for systems that need a
high reliability. This is because in general the overflow may
corrupt data, and the additional corruption may occur due to
reading them unless systems stop.

This patch adds the sysctl parameter
kernel.panic_on_stackoverflow and causes a panic when detecting
the overflows of kernel, IRQ and exception stacks except user
stack according to the parameter. It is disabled by default.

Signed-off-by: Mitsuo Hayasaka 
Cc: yrl.pp-manager.tt@hitachi.com
Cc: Randy Dunlap 
Cc: "H. Peter Anvin" 
Link: http://lkml.kernel.org/r/20111129060836.11076.12323.stgit@ltc219.sdl.hitachi.co.jp
Signed-off-by: Ingo Molnar

kernel/sysctl.c: add cap_last_cap to /proc/sys/kernel

2011-11-01T00:30:53+00:00

Userspace needs to know the highest valid capability of the running
kernel, which right now cannot reliably be retrieved from the header files
only.  The fact that this value cannot be determined properly right now
creates various problems for libraries compiled on newer header files
which are run on older kernels.  They assume capabilities are available
which actually aren't.  libcap-ng is one example.  And we ran into the
same problem with systemd too.

Now the capability is exported in /proc/sys/kernel/cap_last_cap.

[akpm@linux-foundation.org: make cap_last_cap const, per Ulrich]
Signed-off-by: Dan Ballard 
Cc: Randy Dunlap 
Cc: Ingo Molnar 
Cc: Lennart Poettering 
Cc: Kay Sievers 
Cc: Ulrich Drepper 
Cc: James Morris 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

ipc: introduce shm_rmid_forced sysctl

2011-07-26T23:49:44+00:00

Add support for the shm_rmid_forced sysctl.  If set to 1, all shared
memory objects in current ipc namespace will be automatically forced to
use IPC_RMID.

The POSIX way of handling shmem allows one to create shm objects and
call shmdt(), leaving shm object associated with no process, thus
consuming memory not counted via rlimits.

With shm_rmid_forced=1 the shared memory object is counted at least for
one process, so OOM killer may effectively kill the fat process holding
the shared memory.

It obviously breaks POSIX - some programs relying on the feature would
stop working.  So set shm_rmid_forced=1 only if you're sure nobody uses
"orphaned" memory.  Use shm_rmid_forced=0 by default for compatability
reasons.

The feature was previously impemented in -ow as a configure option.

[akpm@linux-foundation.org: fix documentation, per Randy]
[akpm@linux-foundation.org: fix warning]
[akpm@linux-foundation.org: readability/conventionality tweaks]
[akpm@linux-foundation.org: fix shm_rmid_forced/shm_forced_rmid confusion, use standard comment layout]
Signed-off-by: Vasiliy Kulikov 
Cc: Randy Dunlap 
Cc: "Eric W. Biederman" 
Cc: "Serge E. Hallyn" 
Cc: Daniel Lezcano 
Cc: Oleg Nesterov 
Cc: Tejun Heo 
Cc: Ingo Molnar 
Cc: Alan Cox 
Cc: Solar Designer 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

Documentation: refresh sysctl/kernel.txt

2011-07-23T17:58:08+00:00

Refresh sysctl/kernel.txt.  More specifically,

 - drop stale index entries
 - sync and sort index and entries
 - reflow sticking out paragraphs to colwidth 72
 - correct typos
 - cleanup whitespace

Signed-off-by: Borislav Petkov 
Signed-off-by: Randy Dunlap 
Signed-off-by: Linus Torvalds

coredump: add support for exe_file in core name

2011-05-27T00:12:36+00:00

Now, exe_file is not proc FS dependent, so we can use it to name core
file.  So we add %E pattern for core file name cration which extract path
from mm_struct->exe_file.  Then it converts slashes to exclamation marks
and pastes the result to the core file name itself.

This is useful for environments where binary names are longer than 16
character (the current->comm limitation).  Also where there are binaries
with same name but in a different path.  Further in case the binery itself
changes its current->comm after exec.

So by doing (s/$/#/ -- # is treated as git comment):

  $ sysctl kernel.core_pattern='core.%p.%e.%E'
  $ ln /bin/cat cat45678901234567890
  $ ./cat45678901234567890
  ^Z
  $ rm cat45678901234567890
  $ fg
  ^\Quit (core dumped)
  $ ls core*

we now get:

  core.2434.cat456789012345.!root!cat45678901234567890 (deleted)

Signed-off-by: Jiri Slaby 
Cc: Al Viro 
Cc: Alan Cox 
Reviewed-by: Andi Kleen 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

Documentation: default_message_level is a typo

2011-02-11T14:14:10+00:00

It's default_message_loglevel, not default_message_level.

Signed-off-by: Paul Bolle 
Signed-off-by: Jiri Kosina

kptr_restrict for hiding kernel pointers from unprivileged users

2011-01-13T16:03:08+00:00

Add the %pK printk format specifier and the /proc/sys/kernel/kptr_restrict
sysctl.

The %pK format specifier is designed to hide exposed kernel pointers,
specifically via /proc interfaces.  Exposing these pointers provides an
easy target for kernel write vulnerabilities, since they reveal the
locations of writable structures containing easily triggerable function
pointers.  The behavior of %pK depends on the kptr_restrict sysctl.

If kptr_restrict is set to 0, no deviation from the standard %p behavior
occurs.  If kptr_restrict is set to 1, the default, if the current user
(intended to be a reader via seq_printf(), etc.) does not have CAP_SYSLOG
(currently in the LSM tree), kernel pointers using %pK are printed as 0's.
 If kptr_restrict is set to 2, kernel pointers using %pK are printed as
0's regardless of privileges.  Replacing with 0's was chosen over the
default "(null)", which cannot be parsed by userland %p, which expects
"(nil)".

[akpm@linux-foundation.org: check for IRQ context when !kptr_restrict, save an indent level, s/WARN/WARN_ONCE/]
[akpm@linux-foundation.org: coding-style fixup]
[randy.dunlap@oracle.com: fix kernel/sysctl.c warning]
Signed-off-by: Dan Rosenberg 
Signed-off-by: Randy Dunlap 
Cc: James Morris 
Cc: Eric Dumazet 
Cc: Thomas Graf 
Cc: Eugene Teo 
Cc: Kees Cook 
Cc: Ingo Molnar 
Cc: David S. Miller 
Cc: Peter Zijlstra 
Cc: Eric Paris 

Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds