ACK: [Trusty SRU][PATCH 2/2] aio: mark AIO pseudo-fs noexec

[Colin Ian King]

On 04/09/17 18:54, Kleber Sacilotto de Souza wrote:
> From: Jann Horn <jann at thejh.net>
> 
> CVE-2016-10044
> 
> This ensures that do_mmap() won't implicitly make AIO memory mappings
> executable if the READ_IMPLIES_EXEC personality flag is set.  Such
> behavior is problematic because the security_mmap_file LSM hook doesn't
> catch this case, potentially permitting an attacker to bypass a W^X
> policy enforced by SELinux.
> 
> I have tested the patch on my machine.
> 
> To test the behavior, compile and run this:
> 
>     #define _GNU_SOURCE
>     #include <unistd.h>
>     #include <sys/personality.h>
>     #include <linux/aio_abi.h>
>     #include <err.h>
>     #include <stdlib.h>
>     #include <stdio.h>
>     #include <sys/syscall.h>
> 
>     int main(void) {
>         personality(READ_IMPLIES_EXEC);
>         aio_context_t ctx = 0;
>         if (syscall(__NR_io_setup, 1, &ctx))
>             err(1, "io_setup");
> 
>         char cmd[1000];
>         sprintf(cmd, "cat /proc/%d/maps | grep -F '/[aio]'",
>             (int)getpid());
>         system(cmd);
>         return 0;
>     }
> 
> In the output, "rw-s" is good, "rwxs" is bad.
> 
> Signed-off-by: Jann Horn <jann at thejh.net>
> Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>
> (backported from commit 22f6b4d34fcf039c63a94e7670e0da24f8575a5a)
> [kleber: replaced the inline magic number by the macro AIO_RING_MAGIC,
>  as done by 8dc4379e17cddad7b2088a3f300ded50d2a6d493 mainline]
> Signed-off-by: Kleber Sacilotto de Souza <kleber.souza at canonical.com>
> ---
>  fs/aio.c | 7 ++++++-
>  1 file changed, 6 insertions(+), 1 deletion(-)
> 
> diff --git a/fs/aio.c b/fs/aio.c
> index db7adacb5543..8dd68431ff62 100644
> --- a/fs/aio.c
> +++ b/fs/aio.c
> @@ -208,7 +208,12 @@ static struct dentry *aio_mount(struct file_system_type *fs_type,
>  	static const struct dentry_operations ops = {
>  		.d_dname	= simple_dname,
>  	};
> -	return mount_pseudo(fs_type, "aio:", NULL, &ops, 0xa10a10a1);
> +	struct dentry *root = mount_pseudo(fs_type, "aio:", NULL, &ops,
> +					   AIO_RING_MAGIC);
> +
> +	if (!IS_ERR(root))
> +		root->d_sb->s_iflags |= SB_I_NOEXEC;
> +	return root;
>  }
>  
>  /* aio_setup
> 
Looks good to me

Acked-by: Colin Ian King <colin.king at canonical.com>