Make file credentials available to the seqfile interfaces

A lot of seqfile users seem to be using things like %pK that uses the
credentials of the current process, but that is actually completely
wrong for filesystem interfaces.

The unix semantics for permission checking files is to check permissions
at _open_ time, not at read or write time, and that is not just a small
detail: passing off stdin/stdout/stderr to a suid application and making
the actual IO happen in privileged context is a classic exploit
technique.

So if we want to be able to look at permissions at read time, we need to
use the file open credentials, not the current ones.  Normal file
accesses can just use "f_cred" (or any of the helper functions that do
that, like file_ns_capable()), but the seqfile interfaces do not have
any such options.

It turns out that seq_file _does_ save away the user_ns information of
the file, though.  Since user_ns is just part of the full credential
information, replace that special case with saving off the cred pointer
instead, and suddenly seq_file has all the permission information it
needs.

Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
(cherry picked from commit 34dbbcdbf63360661ff7bda6c5f52f99ac515f92)

Orabug: 29114879
CVE: CVE-2018-17972

Conflict:  Refactored include/linux/seq_file.h to include __GENKSYM__
and UEK_KABI_REPLACE() to pass check_kabi test.

Signed-off-by: John Donnelly <john.p.donnelly@oracle.com>
Reviewed-by: Somasundaram Krishnasamy <somasundaram.krishnasamy@oracle.com>
Signed-off-by: Brian Maly <brian.maly@oracle.com>

diff --git a/fs/seq_file.c b/fs/seq_file.c
index f6b5dac4101188fcb2afa6a0d8b209c7a4fbb72f..aff9eeeba717743b1b96eba860d6538d294fc5df 100644 (file)
--- a/fs/seq_file.c
+++ b/fs/seq_file.c
@@ -53,9 +53,10 @@ int seq_open(struct file *file, const struct seq_operations *op)
        memset(p, 0, sizeof(*p));
        mutex_init(&p->lock);
        p->op = op;
-#ifdef CONFIG_USER_NS
-       p->user_ns = file->f_cred->user_ns;
-#endif
+
+       // No refcounting: the lifetime of 'p' is constrained
+       // to the lifetime of the file.
+       p->file = file;
 
        /*
         * Wrappers around seq_open(e.g. swaps_open) need to be

diff --git a/include/linux/seq_file.h b/include/linux/seq_file.h
index 7848473a5bc8b8af7a76fcabb917e56bf9521038..b4f4611f0ef33d92829478680b38dabe2ec57695 100644 (file)
--- a/include/linux/seq_file.h
+++ b/include/linux/seq_file.h
@@ -7,13 +7,12 @@
 #include <linux/mutex.h>
 #include <linux/cpumask.h>
 #include <linux/nodemask.h>
+#ifndef __GENKSYMS__
+#include <linux/fs.h>
+#include <linux/cred.h>
+#endif
 
 struct seq_operations;
-struct file;
-struct path;
-struct inode;
-struct dentry;
-struct user_namespace;
 
 struct seq_file {
        char *buf;
@@ -27,9 +26,7 @@ struct seq_file {
        struct mutex lock;
        const struct seq_operations *op;
        int poll_event;
-#ifdef CONFIG_USER_NS
-       struct user_namespace *user_ns;
-#endif
+       UEK_KABI_REPLACE(struct user_namespace *user_ns, const struct file *file)
        void *private;
 };
 
@@ -141,7 +138,7 @@ int seq_put_decimal_ll(struct seq_file *m, char delimiter,
 static inline struct user_namespace *seq_user_ns(struct seq_file *seq)
 {
 #ifdef CONFIG_USER_NS
-       return seq->user_ns;
+       return seq->file->f_cred->user_ns;
 #else
        extern struct user_namespace init_user_ns;
        return &init_user_ns;