mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-28 20:02:17 +00:00
00b06da29c
As Andy pointed out that there are races between
force_sig_info_to_task and sigaction[1] when force_sig_info_task. As
Kees discovered[2] ptrace is also able to change these signals.
In the case of seeccomp killing a process with a signal it is a
security violation to allow the signal to be caught or manipulated.
Solve this problem by introducing a new flag SA_IMMUTABLE that
prevents sigaction and ptrace from modifying these forced signals.
This flag is carefully made kernel internal so that no new ABI is
introduced.
Longer term I think this can be solved by guaranteeing short circuit
delivery of signals in this case. Unfortunately reliable and
guaranteed short circuit delivery of these signals is still a ways off
from being implemented, tested, and merged. So I have implemented a much
simpler alternative for now.
[1] https://lkml.kernel.org/r/b5d52d25-7bde-4030-a7b1-7c6f8ab90660@www.fastmail.com
[2] https://lkml.kernel.org/r/202110281136.5CE65399A7@keescook
Cc: stable@vger.kernel.org
Fixes: 307d522f5e ("signal/seccomp: Refactor seccomp signal and coredump generation")
Tested-by: Andrea Righi <andrea.righi@canonical.com>
Tested-by: Kees Cook <keescook@chromium.org>
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
88 lines
1.7 KiB
C
88 lines
1.7 KiB
C
/* SPDX-License-Identifier: GPL-2.0 */
|
|
#ifndef _LINUX_SIGNAL_TYPES_H
|
|
#define _LINUX_SIGNAL_TYPES_H
|
|
|
|
/*
|
|
* Basic signal handling related data type definitions:
|
|
*/
|
|
|
|
#include <linux/list.h>
|
|
#include <uapi/linux/signal.h>
|
|
|
|
typedef struct kernel_siginfo {
|
|
__SIGINFO;
|
|
} kernel_siginfo_t;
|
|
|
|
struct ucounts;
|
|
|
|
/*
|
|
* Real Time signals may be queued.
|
|
*/
|
|
|
|
struct sigqueue {
|
|
struct list_head list;
|
|
int flags;
|
|
kernel_siginfo_t info;
|
|
struct ucounts *ucounts;
|
|
};
|
|
|
|
/* flags values. */
|
|
#define SIGQUEUE_PREALLOC 1
|
|
|
|
struct sigpending {
|
|
struct list_head list;
|
|
sigset_t signal;
|
|
};
|
|
|
|
struct sigaction {
|
|
#ifndef __ARCH_HAS_IRIX_SIGACTION
|
|
__sighandler_t sa_handler;
|
|
unsigned long sa_flags;
|
|
#else
|
|
unsigned int sa_flags;
|
|
__sighandler_t sa_handler;
|
|
#endif
|
|
#ifdef __ARCH_HAS_SA_RESTORER
|
|
__sigrestore_t sa_restorer;
|
|
#endif
|
|
sigset_t sa_mask; /* mask last for extensibility */
|
|
};
|
|
|
|
struct k_sigaction {
|
|
struct sigaction sa;
|
|
#ifdef __ARCH_HAS_KA_RESTORER
|
|
__sigrestore_t ka_restorer;
|
|
#endif
|
|
};
|
|
|
|
#ifdef CONFIG_OLD_SIGACTION
|
|
struct old_sigaction {
|
|
__sighandler_t sa_handler;
|
|
old_sigset_t sa_mask;
|
|
unsigned long sa_flags;
|
|
__sigrestore_t sa_restorer;
|
|
};
|
|
#endif
|
|
|
|
struct ksignal {
|
|
struct k_sigaction ka;
|
|
kernel_siginfo_t info;
|
|
int sig;
|
|
};
|
|
|
|
/* Used to kill the race between sigaction and forced signals */
|
|
#define SA_IMMUTABLE 0x00800000
|
|
|
|
#ifndef __ARCH_UAPI_SA_FLAGS
|
|
#ifdef SA_RESTORER
|
|
#define __ARCH_UAPI_SA_FLAGS SA_RESTORER
|
|
#else
|
|
#define __ARCH_UAPI_SA_FLAGS 0
|
|
#endif
|
|
#endif
|
|
|
|
#define UAPI_SA_FLAGS \
|
|
(SA_NOCLDSTOP | SA_NOCLDWAIT | SA_SIGINFO | SA_ONSTACK | SA_RESTART | \
|
|
SA_NODEFER | SA_RESETHAND | SA_EXPOSE_TAGBITS | __ARCH_UAPI_SA_FLAGS)
|
|
|
|
#endif /* _LINUX_SIGNAL_TYPES_H */
|