linux-stable.git/security, branch v3.12.72

selinux: fix off-by-one in setprocattr

2017-02-16T10:44:42+00:00

commit 0c461cb727d146c9ef2d3e86214f498b78b7d125 upstream.

SELinux tries to support setting/clearing of /proc/pid/attr attributes
from the shell by ignoring terminating newlines and treating an
attribute value that begins with a NUL or newline as an attempt to
clear the attribute.  However, the test for clearing attributes has
always been wrong; it has an off-by-one error, and this could further
lead to reading past the end of the allocated buffer since commit
bb646cdb12e75d82258c2f2e7746d5952d3e321a ("proc_pid_attr_write():
switch to memdup_user()").  Fix the off-by-one error.

Even with this fix, setting and clearing /proc/pid/attr attributes
from the shell is not straightforward since the interface does not
support multiple write() calls (so shells that write the value and
newline separately will set and then immediately clear the attribute,
requiring use of echo -n to set the attribute), whereas trying to use
echo -n "" to clear the attribute causes the shell to skip the
write() call altogether since POSIX says that a zero-length write
causes no side effects. Thus, one must use echo -n to set and echo
without -n to clear, as in the following example:
$ echo -n unconfined_u:object_r:user_home_t:s0 > /proc/$$/attr/fscreate
$ cat /proc/$$/attr/fscreate
unconfined_u:object_r:user_home_t:s0
$ echo "" > /proc/$$/attr/fscreate
$ cat /proc/$$/attr/fscreate

Note the use of /proc/$$ rather than /proc/self, as otherwise
the cat command will read its own attribute value, not that of the shell.

There are no users of this facility to my knowledge; possibly we
should just get rid of it.

UPDATE: Upon further investigation it appears that a local process
with the process:setfscreate permission can cause a kernel panic as a
result of this bug.  This patch fixes CVE-2017-2618.

Signed-off-by: Stephen Smalley 
[PM: added the update about CVE-2017-2618 to the commit description]
Signed-off-by: Paul Moore 
Signed-off-by: Jiri Slaby 

Signed-off-by: James Morris

apparmor: do not expose kernel stack

2017-01-27T10:16:15+00:00

commit f4ee2def2d70692ccff0d55353df4ee594fd0017 upstream.

Do not copy uninitalized fields th.td_hilen, th.td_data.

Signed-off-by: Heinrich Schuchardt 
Signed-off-by: John Johansen 
Signed-off-by: Jiri Slaby

apparmor: fix module parameters can be changed after policy is locked

2017-01-27T10:16:15+00:00

commit 58acf9d911c8831156634a44d0b022d683e1e50c upstream.

the policy_lock parameter is a one way switch that prevents policy
from being further modified. Unfortunately some of the module parameters
can effectively modify policy by turning off enforcement.

split policy_admin_capable into a view check and a full admin check,
and update the admin check to test the policy_lock parameter.

Signed-off-by: John Johansen 
Signed-off-by: Jiri Slaby

apparmor: fix oops in profile_unpack() when policy_db is not present

2017-01-27T10:16:14+00:00

commit 5f20fdfed16bc599a325a145bf0123a8e1c9beea upstream.

BugLink: http://bugs.launchpad.net/bugs/1592547

If unpack_dfa() returns NULL due to the dfa not being present,
profile_unpack() is not checking if the dfa is not present (NULL).

Signed-off-by: John Johansen 
Signed-off-by: Jiri Slaby

apparmor: don't check for vmalloc_addr if kvzalloc() failed

2017-01-27T10:16:13+00:00

commit 3197f5adf539a3ee6331f433a51483f8c842f890 upstream.

Signed-off-by: John Johansen 
Signed-off-by: Jiri Slaby

apparmor: add missing id bounds check on dfa verification

2017-01-27T10:16:13+00:00

commit 15756178c6a65b261a080e21af4766f59cafc112 upstream.

Signed-off-by: John Johansen 
Signed-off-by: Jiri Slaby

apparmor: fix refcount race when finding a child profile

2017-01-27T10:16:12+00:00

commit de7c4cc947f9f56f61520ee7edaf380434a98c8d upstream.

When finding a child profile via an rcu critical section, the profile
may be put and scheduled for deletion after the child is found but
before its refcount is incremented.

Protect against this by repeating the lookup if the profiles refcount
is 0 and is one its way to deletion.

Signed-off-by: John Johansen 
Acked-by: Seth Arnold 
Signed-off-by: Jiri Slaby

apparmor: check that xindex is in trans_table bounds

2017-01-27T10:16:11+00:00

commit 23ca7b640b4a55f8747301b6bd984dd05545f6a7 upstream.

Signed-off-by: John Johansen 
Acked-by: Seth Arnold 
Signed-off-by: Jiri Slaby

apparmor: ensure the target profile name is always audited

2017-01-27T10:16:11+00:00

commit f7da2de01127b58d93cebeab165136d0998e7b1a upstream.

The target profile name was not being correctly audited in a few
cases because the target variable was not being set and gotos
passed the code to set it at apply:

Since it is always based on new_profile just drop the target var
and conditionally report based on new_profile.

Signed-off-by: John Johansen 
Acked-by: Seth Arnold 
Acked-by: Jeff Mahoney 
Signed-off-by: Jiri Slaby

apparmor: fix audit full profile hname on successful load

2017-01-27T10:16:10+00:00

commit 7ee6da25dcce27b6023a8673fdf8be98dcf7cacf upstream.

Currently logging of a successful profile load only logs the basename
of the profile. This can result in confusion when a child profile has
the same name as the another profile in the set. Logging the hname
will ensure there is no confusion.

Signed-off-by: John Johansen 
Acked-by: Seth Arnold 
Signed-off-by: Jiri Slaby