ipc/sem: introduce semctl(SEM_STAT_ANY)

There is a permission discrepancy when consulting shm ipc object
metadata between /proc/sysvipc/sem (0444) and the SEM_STAT semctl
command.  The later does permission checks for the object vs S_IRUGO.
As such there can be cases where EACCESS is returned via syscall but the
info is displayed anyways in the procfs files.

While this might have security implications via info leaking (albeit no
writing to the sma metadata), this behavior goes way back and showing
all the objects regardless of the permissions was most likely an
overlook - so we are stuck with it.  Furthermore, modifying either the
syscall or the procfs file can cause userspace programs to break (ie
ipcs).  Some applications require getting the procfs info (without root
privileges) and can be rather slow in comparison with a syscall -- up to
500x in some reported cases for shm.

This patch introduces a new SEM_STAT_ANY command such that the sem ipc
object permissions are ignored, and only audited instead.  In addition,
I've left the lsm security hook checks in place, as if some policy can
block the call, then the user has no other choice than just parsing the
procfs file.

Link: http://lkml.kernel.org/r/20180215162458.10059-3-dave@stgolabs.net
Signed-off-by: Davidlohr Bueso <dbueso@suse.de>
Reported-by: Robert Kettler <robert.kettler@outlook.com>
Cc: Eric W. Biederman <ebiederm@xmission.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Manfred Spraul <manfred@colorfullife.com>
Cc: Michael Kerrisk <mtk.manpages@gmail.com>
Cc: Michal Hocko <mhocko@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

diff --git a/include/uapi/linux/sem.h b/include/uapi/linux/sem.h
index 9c3e745b065628d893351139988b0af7024dda77..39a1876f039e1d46552278c09993ca61aebd7b63 100644 (file)
--- a/include/uapi/linux/sem.h
+++ b/include/uapi/linux/sem.h
@@ -19,6 +19,7 @@
 /* ipcs ctl cmds */
 #define SEM_STAT 18
 #define SEM_INFO 19
+#define SEM_STAT_ANY 20
 
 /* Obsolete, used only for backwards compatibility and libc5 compiles */
 struct semid_ds {

diff --git a/ipc/sem.c b/ipc/sem.c
index 2994da8ccc7f6d77b72451e96d6c7f4dcc0764c0..06be75d9217ace222500b2ebfa276bdee524f6e3 100644 (file)
--- a/ipc/sem.c
+++ b/ipc/sem.c
@@ -1220,14 +1220,14 @@ static int semctl_stat(struct ipc_namespace *ns, int semid,
        memset(semid64, 0, sizeof(*semid64));
 
        rcu_read_lock();
-       if (cmd == SEM_STAT) {
+       if (cmd == SEM_STAT || cmd == SEM_STAT_ANY) {
                sma = sem_obtain_object(ns, semid);
                if (IS_ERR(sma)) {
                        err = PTR_ERR(sma);
                        goto out_unlock;
                }
                id = sma->sem_perm.id;
-       } else {
+       } else { /* IPC_STAT */
                sma = sem_obtain_object_check(ns, semid);
                if (IS_ERR(sma)) {
                        err = PTR_ERR(sma);
@@ -1235,9 +1235,14 @@ static int semctl_stat(struct ipc_namespace *ns, int semid,
                }
        }
 
-       err = -EACCES;
-       if (ipcperms(ns, &sma->sem_perm, S_IRUGO))
-               goto out_unlock;
+       /* see comment for SHM_STAT_ANY */
+       if (cmd == SEM_STAT_ANY)
+               audit_ipc_obj(&sma->sem_perm);
+       else {
+               err = -EACCES;
+               if (ipcperms(ns, &sma->sem_perm, S_IRUGO))
+                       goto out_unlock;
+       }
 
        err = security_sem_semctl(&sma->sem_perm, cmd);
        if (err)
@@ -1626,6 +1631,7 @@ long ksys_semctl(int semid, int semnum, int cmd, unsigned long arg)
                return semctl_info(ns, semid, cmd, p);
        case IPC_STAT:
        case SEM_STAT:
+       case SEM_STAT_ANY:
                err = semctl_stat(ns, semid, cmd, &semid64);
                if (err < 0)
                        return err;
@@ -1732,6 +1738,7 @@ long compat_ksys_semctl(int semid, int semnum, int cmd, int arg)
                return semctl_info(ns, semid, cmd, p);
        case IPC_STAT:
        case SEM_STAT:
+       case SEM_STAT_ANY:
                err = semctl_stat(ns, semid, cmd, &semid64);
                if (err < 0)
                        return err;

diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 1287013f747d89ecb228e6410ce91402aef60005..927904d0f1151a154b524154141289592683df37 100644 (file)
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -6273,6 +6273,7 @@ static int selinux_sem_semctl(struct kern_ipc_perm *sma, int cmd)
                break;
        case IPC_STAT:
        case SEM_STAT:
+       case SEM_STAT_ANY:
                perms = SEM__GETATTR | SEM__ASSOCIATE;
                break;
        default:

diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
index 0daab3019023489a4122cb1254eb388f80b15f58..cb36498a507623fcc9b201988da14a7492388cb2 100644 (file)
--- a/security/smack/smack_lsm.c
+++ b/security/smack/smack_lsm.c
@@ -3140,6 +3140,7 @@ static int smack_sem_semctl(struct kern_ipc_perm *isp, int cmd)
        case GETALL:
        case IPC_STAT:
        case SEM_STAT:
+       case SEM_STAT_ANY:
                may = MAY_READ;
                break;
        case SETVAL: