Kees Cook f4aacea2f5 sysctl: allow for strict write position handling ... When writing to a sysctl string, each write, regardless of VFS position, begins writing the string from the start. This means the contents of the last write to the sysctl controls the string contents instead of the first: open("/proc/sys/kernel/modprobe", O_WRONLY) = 1 write(1, "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"..., 4096) = 4096 write(1, "/bin/true", 9) = 9 close(1) = 0 $ cat /proc/sys/kernel/modprobe /bin/true Expected behaviour would be to have the sysctl be "AAAA..." capped at maxlen (in this case KMOD_PATH_LEN: 256), instead of truncating to the contents of the second write. Similarly, multiple short writes would not append to the sysctl. The old behavior is unlike regular POSIX files enough that doing audits of software that interact with sysctls can end up in unexpected or dangerous situations. For example, "as long as the input starts with a trusted path" turns out to be an insufficient filter, as what must also happen is for the input to be entirely contained in a single write syscall -- not a common consideration, especially for high level tools. This provides kernel.sysctl_writes_strict as a way to make this behavior act in a less surprising manner for strings, and disallows non-zero file position when writing numeric sysctls (similar to what is already done when reading from non-zero file positions). For now, the default (0) is to warn about non-zero file position use, but retain the legacy behavior. Setting this to -1 disables the warning, and setting this to 1 enables the file position respecting behavior. [akpm@linux-foundation.org: fix build] [akpm@linux-foundation.org: move misplaced hunk, per Randy] Signed-off-by: Kees Cook <keescook@chromium.org> Cc: Randy Dunlap <rdunlap@infradead.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>		2014-06-06 16:08:13 -07:00
..
debug	kernel/printk: use symbolic defines for console loglevels	2014-06-04 16:54:17 -07:00
events	Merge branch 'for-linus' of git://ftp.arm.linux.org.uk/~rmk/linux-arm into next	2014-06-05 15:57:04 -07:00
gcov
irq	genirq: Improve documentation to match current implementation	2014-05-27 10:16:44 +02:00
locking	Merge branch 'sched-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip into next	2014-06-03 14:00:15 -07:00
power	Merge branches 'pnp', 'powercap', 'pm-runtime' and 'pm-opp'	2014-06-03 23:13:00 +02:00
printk	kernel/printk: use symbolic defines for console loglevels	2014-06-04 16:54:17 -07:00
rcu	Merge branch 'locking-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip into next	2014-06-03 12:57:53 -07:00
sched	printk: Add printk_deferred_once	2014-06-04 16:54:17 -07:00
time	Merge branch 'akpm' (patchbomb from Andrew) into next	2014-06-04 16:55:13 -07:00
trace	tracing: Use rcu_dereference_sched() for trace event triggers	2014-05-02 23:12:42 -04:00
.gitignore	Ignore generated file kernel/x509_certificate_list	2013-12-10 18:21:34 +00:00
acct.c
async.c
audit_tree.c	inotify: Fix reporting of cookies for inotify events	2014-02-18 11:17:17 +01:00
audit_watch.c	inotify: Fix reporting of cookies for inotify events	2014-02-18 11:17:17 +01:00
audit.c	net: Use netlink_ns_capable to verify the permisions of netlink messages	2014-04-24 13:44:54 -04:00
audit.h	audit: Use struct net not pid_t to remember the network namespce to reply in	2014-03-20 10:10:53 -04:00
auditfilter.c	Merge git://git.infradead.org/users/eparis/audit	2014-04-12 12:38:53 -07:00
auditsc.c	Merge git://git.infradead.org/users/eparis/audit	2014-04-12 12:38:53 -07:00
backtracetest.c	kernel/backtracetest.c: replace no level printk by pr_info()	2014-06-04 16:54:14 -07:00
bounds.c	mm: do not allocate page->ptl dynamically, if spinlock_t fits to long	2013-12-20 12:25:45 -08:00
capability.c	kernel/capability.c: code clean-up	2014-06-04 16:54:15 -07:00
cgroup_freezer.c	cgroup: fix rcu_read_lock() leak in update_if_frozen()	2014-05-13 11:28:30 -04:00
cgroup.c	kernfs: move the last knowledge of sysfs out from kernfs	2014-05-27 14:33:17 -07:00
compat.c	kernel/compat.c: use sizeof() instead of sizeof	2014-06-04 16:54:19 -07:00
configs.c
context_tracking.c	asmlinkage: Add explicit __visible to drivers/*, lib/*, kernel/*	2014-05-05 16:07:46 -07:00
cpu_pm.c
cpu.c	kernel/cpu.c: convert printk to pr_foo()	2014-06-04 16:54:14 -07:00
cpuset.c	mm: page_alloc: use jump labels to avoid checking number_of_cpusets	2014-06-04 16:54:08 -07:00
crash_dump.c
cred.c
delayacct.c
dma.c
elfcore.c
exec_domain.c	kernel/exec_domain.c: code clean-up	2014-06-04 16:54:15 -07:00
exit.c	signals: mv {dis,}allow_signal() from sched.h/exit.c to signal.[ch]	2014-06-06 16:08:11 -07:00
extable.c	asmlinkage: Make main_extable_sort_needed visible	2014-02-13 18:13:22 -08:00
fork.c	ptrace: fix fork event messages across pid namespaces	2014-06-06 16:08:11 -07:00
freezer.c	libata, freezer: avoid block device removal while system is frozen	2013-12-19 13:50:32 -05:00
futex_compat.c	compat: Get rid of (get|put)_compat_time(val|spec)	2014-02-02 14:09:12 -08:00
futex.c	Merge branch 'locking-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip into next	2014-06-03 12:57:53 -07:00
groups.c	kernel/groups.c: remove return value of set_groups	2014-04-03 16:21:05 -07:00
hrtimer.c	Merge branch 'perf-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip into next	2014-06-03 13:18:00 -07:00
hung_task.c	kernel/hung_task.c: convert simple_strtoul to kstrtouint	2014-06-04 16:54:15 -07:00
irq_work.c	perf/x86: Warn to early_printk() in case irq_work is too slow	2014-02-21 21:49:07 +01:00
itimer.c
jump_label.c
kallsyms.c	kernel: use macros from compiler.h instead of __attribute__((...))	2014-04-07 16:36:11 -07:00
kcmp.c
Kconfig.freezer
Kconfig.hz
Kconfig.locks
Kconfig.preempt
kexec.c	kernel/kexec.c: convert printk to pr_foo()	2014-06-06 16:08:12 -07:00
kmod.c	signals: change wait_for_helper() to use kernel_sigaction()	2014-06-06 16:08:12 -07:00
kprobes.c
ksysfs.c	kobject: Make support for uevent_helper optional.	2014-04-25 12:00:49 -07:00
kthread.c	kthread: fix return value of kthread_create() upon SIGKILL.	2014-06-04 16:53:51 -07:00
latencytop.c	kernel/latencytop.c: convert seq_printf to seq_puts	2014-06-04 16:54:15 -07:00
Makefile	Merge branch 'x86-asmlinkage-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2014-03-31 14:13:25 -07:00
module_signing.c
module-internal.h
module.c	Fixed one missing place for the new taint flag, and remove a warning	2014-05-01 10:35:01 -07:00
notifier.c	notifier: Substitute rcu_access_pointer() for rcu_dereference_raw()	2014-02-26 06:35:13 -08:00
nsproxy.c
padata.c
panic.c	kernel/panic.c: add "crash_kexec_post_notifiers" option for kdump after panic_notifers	2014-06-06 16:08:12 -07:00
params.c
pid_namespace.c	pid_namespace: pidns_get() should check task_active_pid_ns() != NULL	2014-04-02 16:20:21 -07:00
pid.c
posix-cpu-timers.c	posix-timers: Convert abuses of BUG_ON to WARN_ON	2013-12-09 16:56:29 +01:00
posix-timers.c
profile.c	CPU hotplug notifiers registration fixes for 3.15-rc1	2014-04-07 14:55:46 -07:00
ptrace.c	kernel/compat: convert to COMPAT_SYSCALL_DEFINE	2014-03-06 15:35:10 +01:00
range.c
reboot.c	kernel/reboot.c: convert simple_strtoul to kstrtoint	2014-06-04 16:54:15 -07:00
relay.c	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2014-04-12 14:49:50 -07:00
res_counter.c	kernel/res_counter.c: replace simple_strtoull by kstrtoull	2014-06-04 16:54:15 -07:00
resource.c	resources: Clarify sanity check message	2014-05-23 10:47:21 -06:00
seccomp.c	seccomp: fix memory leak on filter attach	2014-04-16 15:25:53 -04:00
signal.c	signals: introduce kernel_sigaction()	2014-06-06 16:08:12 -07:00
smp.c	smp: print more useful debug info upon receiving IPI on an offline CPU	2014-06-06 16:08:12 -07:00
smpboot.c
smpboot.h
softirq.c	Merge branch 'rcu/next' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu into core/rcu	2014-05-22 11:36:10 +02:00
stacktrace.c
stop_machine.c	kernel/stop_machine.c: kernel-doc warning fix	2014-06-04 16:54:15 -07:00
sys_ni.c	sys_sgetmask/sys_ssetmask: add CONFIG_SGETMASK_SYSCALL	2014-06-04 16:54:14 -07:00
sys.c	sched: Consolidate open coded implementations of nice level frobbing into nice_to_rlimit() and rlimit_to_nice()	2014-05-22 11:16:36 +02:00
sysctl_binary.c
sysctl.c	sysctl: allow for strict write position handling	2014-06-06 16:08:13 -07:00
system_certificates.S	KEYS: correct alignment of system_certificate_list content in assembly file	2013-12-10 18:25:28 +00:00
system_keyring.c	KEYS: correct alignment of system_certificate_list content in assembly file	2013-12-10 18:25:28 +00:00
task_work.c
taskstats.c
test_kprobes.c
time.c
timeconst.bc
timer.c	timer: Prevent overflow in apply_slack	2014-04-30 13:46:17 +02:00
torture.c	torture: Remove __init from torture_init_begin/end	2014-05-14 09:46:30 -07:00
tracepoint.c	kernel/tracepoint.c: kernel-doc fixes	2014-06-04 16:54:15 -07:00
tsacct.c
uid16.c
up.c	smp: Rename __smp_call_function_single() to smp_call_function_single_async()	2014-02-24 14:47:15 -08:00
user_namespace.c	user namespace: fix incorrect memory barriers	2014-04-14 16:03:02 -07:00
user-return-notifier.c
user.c	kernel/user.c: drop unused field 'files' from user_struct	2014-06-04 16:54:16 -07:00
utsname_sysctl.c	kernel/utsname_sysctl.c: replace obsolete __initcall by device_initcall	2014-06-04 16:54:15 -07:00
utsname.c
watchdog.c	kernel/watchdog.c:touch_softlockup_watchdog(): use raw_cpu_write()	2014-04-18 16:40:08 -07:00
workqueue_internal.h
workqueue.c	Linux 3.15-rc6	2014-05-22 10:28:56 +02:00