ipc/msg: introduce msgctl(MSG_STAT_ANY)

There is a permission discrepancy when consulting msq ipc object
metadata between /proc/sysvipc/msg (0444) and the MSG_STAT shmctl
command.  The later does permission checks for the object vs S_IRUGO.
As such there can be cases where EACCESS is returned via syscall but the
info is displayed anyways in the procfs files.

While this might have security implications via info leaking (albeit no
writing to the msq metadata), this behavior goes way back and showing
all the objects regardless of the permissions was most likely an
overlook - so we are stuck with it.  Furthermore, modifying either the
syscall or the procfs file can cause userspace programs to break (ie
ipcs).  Some applications require getting the procfs info (without root
privileges) and can be rather slow in comparison with a syscall -- up to
500x in some reported cases for shm.

This patch introduces a new MSG_STAT_ANY command such that the msq ipc
object permissions are ignored, and only audited instead.  In addition,
I've left the lsm security hook checks in place, as if some policy can
block the call, then the user has no other choice than just parsing the
procfs file.

Link: http://lkml.kernel.org/r/20180215162458.10059-4-dave@stgolabs.net
Signed-off-by: Davidlohr Bueso <dbueso@suse.de>
Reported-by: Robert Kettler <robert.kettler@outlook.com>
Cc: Eric W. Biederman <ebiederm@xmission.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Manfred Spraul <manfred@colorfullife.com>
Cc: Michael Kerrisk <mtk.manpages@gmail.com>
Cc: Michal Hocko <mhocko@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

diff --git a/include/uapi/linux/msg.h b/include/uapi/linux/msg.h
index 5d5ab81dc9be8ec46ad62228807e8e99153b3bf8..e4a0d9a9a9e80c8ade302d4a93c373e3a3f0423c 100644 (file)
--- a/include/uapi/linux/msg.h
+++ b/include/uapi/linux/msg.h
@@ -7,6 +7,7 @@
 /* ipcs ctl commands */
 #define MSG_STAT 11
 #define MSG_INFO 12
+#define MSG_STAT_ANY 13
 
 /* msgrcv options */
 #define MSG_NOERROR     010000  /* no error if message is too big */

diff --git a/ipc/msg.c b/ipc/msg.c
index 114a211896131c65b389f851b6bf33a7bef99ba1..56fd1c73eedccc93ea3f26f0f74e9dbe2c5b7bf8 100644 (file)
--- a/ipc/msg.c
+++ b/ipc/msg.c
@@ -497,14 +497,14 @@ static int msgctl_stat(struct ipc_namespace *ns, int msqid,
        memset(p, 0, sizeof(*p));
 
        rcu_read_lock();
-       if (cmd == MSG_STAT) {
+       if (cmd == MSG_STAT || cmd == MSG_STAT_ANY) {
                msq = msq_obtain_object(ns, msqid);
                if (IS_ERR(msq)) {
                        err = PTR_ERR(msq);
                        goto out_unlock;
                }
                id = msq->q_perm.id;
-       } else {
+       } else { /* IPC_STAT */
                msq = msq_obtain_object_check(ns, msqid);
                if (IS_ERR(msq)) {
                        err = PTR_ERR(msq);
@@ -512,9 +512,14 @@ static int msgctl_stat(struct ipc_namespace *ns, int msqid,
                }
        }
 
-       err = -EACCES;
-       if (ipcperms(ns, &msq->q_perm, S_IRUGO))
-               goto out_unlock;
+       /* see comment for SHM_STAT_ANY */
+       if (cmd == MSG_STAT_ANY)
+               audit_ipc_obj(&msq->q_perm);
+       else {
+               err = -EACCES;
+               if (ipcperms(ns, &msq->q_perm, S_IRUGO))
+                       goto out_unlock;
+       }
 
        err = security_msg_queue_msgctl(&msq->q_perm, cmd);
        if (err)
@@ -572,6 +577,7 @@ long ksys_msgctl(int msqid, int cmd, struct msqid_ds __user *buf)
                return err;
        }
        case MSG_STAT:  /* msqid is an index rather than a msg queue id */
+       case MSG_STAT_ANY:
        case IPC_STAT:
                err = msgctl_stat(ns, msqid, cmd, &msqid64);
                if (err < 0)
@@ -690,6 +696,7 @@ long compat_ksys_msgctl(int msqid, int cmd, void __user *uptr)
        }
        case IPC_STAT:
        case MSG_STAT:
+       case MSG_STAT_ANY:
                err = msgctl_stat(ns, msqid, cmd, &msqid64);
                if (err < 0)
                        return err;

diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 927904d0f1151a154b524154141289592683df37..4cafe6a19167613cb64b29ac59c895e91285b390 100644 (file)
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -6006,6 +6006,7 @@ static int selinux_msg_queue_msgctl(struct kern_ipc_perm *msq, int cmd)
                                    SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
        case IPC_STAT:
        case MSG_STAT:
+       case MSG_STAT_ANY:
                perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
                break;
        case IPC_SET:

diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
index cb36498a507623fcc9b201988da14a7492388cb2..0b414836bebdcc619c49dd0d4747510b8d6be376 100644 (file)
--- a/security/smack/smack_lsm.c
+++ b/security/smack/smack_lsm.c
@@ -3230,6 +3230,7 @@ static int smack_msg_queue_msgctl(struct kern_ipc_perm *isp, int cmd)
        switch (cmd) {
        case IPC_STAT:
        case MSG_STAT:
+       case MSG_STAT_ANY:
                may = MAY_READ;
                break;
        case IPC_SET: