If the system is running with PROC_MEM_FORCE_ALWAYS, LSMs currently have no good opportunity to block a process from overwriting read-only code in its own address space through FOLL_FORCE writes via /proc/self/mem. The security_ptrace_access_check() LSM hook is bypassed when a process opens /proc/self/mem because this is considered "introspection". This causes a hole in SELinux EXECMEM enforcement, which tries to ensure that a process cannot create executable anonymous pages. PROC_MEM_FORCE_PTRACE prevents that and ensures that such FOLL_FORCE accesses are only possible when the LSM allows ptrace() attachment; but it is unclear how quickly PROC_MEM_FORCE_PTRACE can be deployed in environments running lots of third-party code, such as Android. So, introduce a new LSM hook that can forbid FOLL_FORCE specifically for such "introspective" accesses. Signed-off-by: Jann Horn --- fs/proc/base.c | 6 ++++++ include/linux/lsm_hook_defs.h | 1 + include/linux/security.h | 6 ++++++ security/security.c | 15 +++++++++++++++ 4 files changed, 28 insertions(+) diff --git a/fs/proc/base.c b/fs/proc/base.c index bec6197329dc..3dfaef49bb70 100644 --- a/fs/proc/base.c +++ b/fs/proc/base.c @@ -851,6 +851,8 @@ static int __mem_open(struct inode *inode, struct file *file, unsigned int mode) /* private_data for proc_mem_operations */ struct mem_private { struct mm_struct *mm; + /* Was the ptrace access check bypassed due to introspection? */ + bool introspection; }; static int mem_open(struct inode *inode, struct file *file) @@ -864,12 +866,14 @@ static int mem_open(struct inode *inode, struct file *file) priv->mm = proc_mem_open(inode, PTRACE_MODE_ATTACH); if (IS_ERR_OR_NULL(priv->mm)) return priv->mm ? PTR_ERR(priv->mm) : -ESRCH; + priv->introspection = priv->mm == current->mm; file->private_data = no_free_ptr(priv); return 0; } static bool proc_mem_foll_force(struct file *file, struct mm_struct *mm) { + struct mem_private *priv = file->private_data; struct task_struct *task; bool ptrace_active = false; @@ -886,6 +890,8 @@ static bool proc_mem_foll_force(struct file *file, struct mm_struct *mm) } return ptrace_active; default: + if (priv->introspection) + return security_introspect_mem_foll_force(file->f_cred) == 0; return true; } } diff --git a/include/linux/lsm_hook_defs.h b/include/linux/lsm_hook_defs.h index 65c9609ec207..67452f71bedf 100644 --- a/include/linux/lsm_hook_defs.h +++ b/include/linux/lsm_hook_defs.h @@ -36,6 +36,7 @@ LSM_HOOK(int, 0, binder_transfer_file, const struct cred *from, LSM_HOOK(int, 0, ptrace_access_check, struct task_struct *child, unsigned int mode) LSM_HOOK(int, 0, ptrace_traceme, struct task_struct *parent) +LSM_HOOK(int, 0, introspect_mem_foll_force, const struct cred *subject) LSM_HOOK(int, 0, capget, const struct task_struct *target, kernel_cap_t *effective, kernel_cap_t *inheritable, kernel_cap_t *permitted) LSM_HOOK(int, 0, capset, struct cred *new, const struct cred *old, diff --git a/include/linux/security.h b/include/linux/security.h index 153e9043058f..f8483be58bc8 100644 --- a/include/linux/security.h +++ b/include/linux/security.h @@ -338,6 +338,7 @@ int security_binder_transfer_file(const struct cred *from, const struct cred *to, const struct file *file); int security_ptrace_access_check(struct task_struct *child, unsigned int mode); int security_ptrace_traceme(struct task_struct *parent); +int security_introspect_mem_foll_force(const struct cred *subject); int security_capget(const struct task_struct *target, kernel_cap_t *effective, kernel_cap_t *inheritable, @@ -676,6 +677,11 @@ static inline int security_ptrace_traceme(struct task_struct *parent) return cap_ptrace_traceme(parent); } +static inline int security_introspect_mem_foll_force(const struct cred *subject) +{ + return 0; +} + static inline int security_capget(const struct task_struct *target, kernel_cap_t *effective, kernel_cap_t *inheritable, diff --git a/security/security.c b/security/security.c index 71aea8fdf014..d0f790a534eb 100644 --- a/security/security.c +++ b/security/security.c @@ -595,6 +595,21 @@ int security_ptrace_traceme(struct task_struct *parent) return call_int_hook(ptrace_traceme, parent); } +/** + * security_introspect_mem_foll_force() - Check if introspective FOLL_FORCE is allowed + * @subject: credentials of the process accessing its own memory + * + * Check if FOLL_FORCE is allowed for a process accessing its own memory, which + * bypasses the security_ptrace_access_check() hook. + * This is only used when the system is configured with PROC_MEM_FORCE_ALWAYS. + * + * Return: Returns 0 if permission is granted. + */ +int security_introspect_mem_foll_force(const struct cred *subject) +{ + return call_int_hook(introspect_mem_foll_force, subject); +} + /** * security_capget() - Get the capability sets for a process * @target: target process -- 2.55.0.737.g08866a6d13-goog