BACKPORT: aio: mark AIO pseudo-fs noexec
authorNick Desaulniers <ndesaulniers@google.com>
Mon, 16 Jan 2017 12:58:30 +0000 (17:58 +0530)
committerManish Tuteja <mtuteja@nvidia.com>
Wed, 1 Mar 2017 00:37:16 +0000 (16:37 -0800)
commit47e55811d1761cc086951fe600753b723ec7895f
tree19e009cc955b64fcaf18c296858a8419ab9e6563
parent7a6394a97b38d484e09272d56ef876a8784e8392
BACKPORT: aio: mark AIO pseudo-fs noexec

This ensures that do_mmap() won't implicitly make AIO memory mappings
executable if the READ_IMPLIES_EXEC personality flag is set.  Such
behavior is problematic because the security_mmap_file LSM hook doesn't
catch this case, potentially permitting an attacker to bypass a W^X
policy enforced by SELinux.

I have tested the patch on my machine.

To test the behavior, compile and run this:

    #define _GNU_SOURCE
    #include <unistd.h>
    #include <sys/personality.h>
    #include <linux/aio_abi.h>
    #include <err.h>
    #include <stdlib.h>
    #include <stdio.h>
    #include <sys/syscall.h>

    int main(void) {
        personality(READ_IMPLIES_EXEC);
        aio_context_t ctx = 0;
        if (syscall(__NR_io_setup, 1, &ctx))
            err(1, "io_setup");

        char cmd[1000];
        sprintf(cmd, "cat /proc/%d/maps | grep -F '/[aio]'",
            (int)getpid());
        system(cmd);
        return 0;
    }

In the output, "rw-s" is good, "rwxs" is bad.

Signed-off-by: Jann Horn <jann@thejh.net>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
(cherry picked from commit 22f6b4d34fcf039c63a94e7670e0da24f8575a5a)

Bug: 31711619
Bug 1858126
CVE-2016-10044 (A-31711619)

Change-Id: I9f2872703bef240d6b82320c744529459bb076dc
Signed-off-by: Gagan Grover <ggrover@nvidia.com>
Reviewed-on: http://git-master/r/1285940
(cherry picked from commit b552c94fbcad36a52973a1141adafbe351b75b90)
Reviewed-on: http://git-master/r/1299533
(cherry picked from commit 79d1f35c10e5438fbb441cd1524b02cda377e04f)
Reviewed-on: http://git-master/r/1311426
GVS: Gerrit_Virtual_Submit
Reviewed-by: Vinayak Pane <vpane@nvidia.com>
fs/aio.c