exec: Set file unwritable before LSM check
The LSM check should happen after the file has been confirmed to be unchanging. Without this, we could have a race between the Time of Check (the call to security_kernel_read_file() which could read the file and make access policy decisions) and the Time of Use (starting with kernel_read_file()'s reading of the file contents). In theory, file contents could change between the two. Signed-off-by: Kees Cook <keescook@chromium.org> Reviewed-by: Mimi Zohar <zohar@linux.vnet.ibm.com> Signed-off-by: James Morris <james.morris@microsoft.com>
This commit is contained in:
parent
6b4f3d0105
commit
7bd698b3c0
|
@ -895,14 +895,14 @@ int kernel_read_file(struct file *file, void **buf, loff_t *size,
|
||||||
if (!S_ISREG(file_inode(file)->i_mode) || max_size < 0)
|
if (!S_ISREG(file_inode(file)->i_mode) || max_size < 0)
|
||||||
return -EINVAL;
|
return -EINVAL;
|
||||||
|
|
||||||
ret = security_kernel_read_file(file, id);
|
|
||||||
if (ret)
|
|
||||||
return ret;
|
|
||||||
|
|
||||||
ret = deny_write_access(file);
|
ret = deny_write_access(file);
|
||||||
if (ret)
|
if (ret)
|
||||||
return ret;
|
return ret;
|
||||||
|
|
||||||
|
ret = security_kernel_read_file(file, id);
|
||||||
|
if (ret)
|
||||||
|
goto out;
|
||||||
|
|
||||||
i_size = i_size_read(file_inode(file));
|
i_size = i_size_read(file_inode(file));
|
||||||
if (max_size > 0 && i_size > max_size) {
|
if (max_size > 0 && i_size > max_size) {
|
||||||
ret = -EFBIG;
|
ret = -EFBIG;
|
||||||
|
|
Loading…
Reference in New Issue