Ryan Mallon 312b4e2269 vsprintf: check real user/group id for %pK ... Some setuid binaries will allow reading of files which have read permission by the real user id. This is problematic with files which use %pK because the file access permission is checked at open() time, but the kptr_restrict setting is checked at read() time. If a setuid binary opens a %pK file as an unprivileged user, and then elevates permissions before reading the file, then kernel pointer values may be leaked. This happens for example with the setuid pppd application on Ubuntu 12.04: $ head -1 /proc/kallsyms 00000000 T startup_32 $ pppd file /proc/kallsyms pppd: In file /proc/kallsyms: unrecognized option 'c1000000' This will only leak the pointer value from the first line, but other setuid binaries may leak more information. Fix this by adding a check that in addition to the current process having CAP_SYSLOG, that effective user and group ids are equal to the real ids. If a setuid binary reads the contents of a file which uses %pK then the pointer values will be printed as NULL if the real user is unprivileged. Update the sysctl documentation to reflect the changes, and also correct the documentation to state the kptr_restrict=0 is the default. This is a only temporary solution to the issue. The correct solution is to do the permission check at open() time on files, and to replace %pK with a function which checks the open() time permission. %pK uses in printk should be removed since no sane permission check can be done, and instead protected by using dmesg_restrict. Signed-off-by: Ryan Mallon <rmallon@gmail.com> Cc: Kees Cook <keescook@chromium.org> Cc: Alexander Viro <viro@zeniv.linux.org.uk> Cc: Joe Perches <joe@perches.com> Cc: "Eric W. Biederman" <ebiederm@xmission.com> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>		2013-11-13 12:09:14 +09:00
..
ABI	Staging driver update for 3.13-rc1	2013-11-07 15:07:58 +09:00
DocBook	Merge branch 'irq-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2013-11-12 10:04:41 +09:00
EDID	…
PCI	…
RCU	rcu: Fix occurrence of "the the" in checklist.txt	2013-09-25 10:07:02 -07:00
accounting	…
acpi	gpiolib / ACPI: document the GPIO descriptor based interface	2013-10-19 23:32:50 +02:00
aoe	aoe: remove do-nothing NAME="%k" term from example udev rules	2013-09-11 15:59:28 -07:00
arm	Allwinner sunXi SoCs machine additions for 3.13	2013-10-28 10:19:38 -07:00
arm64	arm64: Use 42-bit address space with 64K pages	2013-11-05 17:23:52 +00:00
auxdisplay	…
backlight	…
blackfin	…
block	block: change config option name for cmdline partition parsing	2013-09-30 14:31:02 -07:00
blockdev	…
bus-devices	…
cdrom	…
cgroups	memcg: support hierarchical memory.numa_stats	2013-11-13 12:09:06 +09:00
connector	connector - documentation: simplify netlink message length assignment	2013-10-02 16:03:51 -04:00
console	…
cpu-freq	…
cpuidle	…
cris	…
crypto	…
development-process	…
device-mapper	dm: add statistics support	2013-09-05 20:46:06 -04:00
devicetree	DeviceTree updates for 3.13. This is a bit larger pull request than	2013-11-12 16:52:17 +09:00
driver-model	spi: Updates for v3.13	2013-11-12 15:01:39 +09:00
dvb	…
early-userspace	…
extcon	extcon: Simplify extcon_dev_register() prototype by removing unnecessary parameter	2013-09-27 09:37:01 +09:00
fault-injection	…
fb	…
filesystems	/proc/pid/smaps: show VM_SOFTDIRTY flag in VmFlags line	2013-11-13 12:09:07 +09:00
firmware_class	…
fmc	doc: Fix typo "is is" in Documentations	2013-08-27 10:50:52 +02:00
frv	…
hid	…
hwmon	hwmon: (pmbus/ltc2978): Add support for LTC2978A	2013-10-18 09:12:03 -07:00
i2c	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial	2013-09-06 09:36:28 -07:00
i2o	…
ia64	…
ide	…
infiniband	…
input	Merge branch 'master' into for-3.12/upstream	2013-09-04 10:49:57 +02:00
ioctl	ALSA: add DICE driver	2013-10-17 21:18:32 +02:00
isdn	…
ja_JP	…
kbuild	kconfig: do not allow more than one symbol to have 'option modules'	2013-09-05 11:10:08 +02:00
kdump	…
ko_KR	…
laptops	thinkpad-acpi: Add mute and mic-mute LED functionality	2013-10-17 14:38:44 +02:00
leds	Documentation: leds-lp5521,lp5523: update device attribute information	2013-08-26 17:22:13 -07:00
m68k	…
make	…
memory-devices	…
metag	…
mic	misc: mic: Enable OSPM suspend and resume support.	2013-10-05 18:01:42 -07:00
mips	…
misc-devices	…
mmc	…
mn10300	…
mtd	doc: Fix typo "is is" in Documentations	2013-08-27 10:50:52 +02:00
namespaces	…
netlabel	…
networking	doc:net: Fix typo in Documentation/networking	2013-10-30 17:10:20 -04:00
nfc	…
parisc	…
pcmcia	…
power	power: Documentation: Update s2ram link	2013-08-27 10:54:52 +02:00
powerpc	powerpc: Update the 00-Index in Documentation/powerpc	2013-08-27 14:44:27 +10:00
pps	USB: serial: invoke dcd_change ldisc's handler.	2013-09-26 09:45:40 -07:00
prctl	…
pti	…
ptp	…
rapidio	…
s390	s390/s390dbf: add debug_level_enabled() function	2013-10-24 17:16:53 +02:00
scheduler	H8/300 has been dead for several years, the kernel for it has	2013-11-12 14:13:14 +09:00
scsi	SCSI misc on 20130915	2013-09-15 17:41:30 -04:00
security	…
serial	serial: core: delete .set_wake() callback	2013-10-16 13:16:19 -07:00
sh	…
sound	ALSA: Fix typo in documentation/alsa	2013-10-29 11:38:04 +01:00
spi	…
sysctl	vsprintf: check real user/group id for %pK	2013-11-13 12:09:14 +09:00
target	…
thermal	thermal: thermal_core: allow binding with limits on bind_params	2013-09-03 09:10:24 -04:00
timers	…
tpm	…
trace	ftrace, sched: Add TRACE_FLAG_PREEMPT_RESCHED	2013-11-11 12:43:39 +01:00
usb	…
vDSO	…
video4linux	…
virtual	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial	2013-09-06 09:36:28 -07:00
vm	Documentation/vm/zswap.txt: fix typos	2013-11-13 12:09:05 +09:00
w1	…
watchdog	…
wimax	…
x86	Merge branch 'x86-efi-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2013-11-12 10:48:30 +09:00
xtensa	…
zh_CN	…
.gitignore	…
00-INDEX	doc: fix a typo in Documentation/00-INDEX	2013-08-27 10:53:07 +02:00
BUG-HUNTING	…
Changes	…
CodingStyle	…
DMA-API-HOWTO.txt	…
DMA-API.txt	…
DMA-ISA-LPC.txt	…
DMA-attributes.txt	…
HOWTO	…
IPMI.txt	…
IRQ-affinity.txt	…
IRQ-domain.txt	…
IRQ.txt	…
Intel-IOMMU.txt	…
Makefile	…
ManagementStyle	…
SAK.txt	…
SM501.txt	…
SecurityBugs	…
SubmitChecklist	…
SubmittingDrivers	…
SubmittingPatches	…
VGA-softcursor.txt	…
applying-patches.txt	…
atomic_ops.txt	…
bad_memory.txt	…
basic_profiling.txt	…
bcache.txt	…
binfmt_misc.txt	…
braille-console.txt	…
bt8xxgpio.txt	…
btmrvl.txt	…
bus-virt-phys-mapping.txt	…
cachetlb.txt	…
circular-buffers.txt	…
clk.txt	…
coccinelle.txt	…
cpu-hotplug.txt	…
cpu-load.txt	…
cputopology.txt	doc: Documentation/cputopology.txt fix typo	2013-09-04 12:59:47 +02:00
crc32.txt	…
dcdbas.txt	…
debugging-modules.txt	…
debugging-via-ohci1394.txt	…
dell_rbu.txt	…
devices.txt	…
digsig.txt	…
dma-buf-sharing.txt	dma-buf: Expose buffer size to userspace (v2)	2013-09-10 11:36:45 +05:30
dmaengine.txt	…
dmatest.txt	dmatest: make module parameters writable	2013-08-22 22:57:32 -07:00
dontdiff	…
dynamic-debug-howto.txt	…
edac.txt	…
efi-stub.txt	EFI stub documentation updates	2013-09-25 12:34:32 +01:00
eisa.txt	…
email-clients.txt	…
flexible-arrays.txt	…
futex-requeue-pi.txt	…
gcov.txt	…
gpio.txt	…
highuid.txt	…
hw_random.txt	…
hwspinlock.txt	doc: documentation/hwspinlock.txt fix typo	2013-08-27 10:46:02 +02:00
init.txt	…
initrd.txt	…
intel_txt.txt	…
io-mapping.txt	…
io_ordering.txt	…
iostats.txt	…
irqflags-tracing.txt	…
isapnp.txt	…
java.txt	…
kernel-doc-nano-HOWTO.txt	…
kernel-docs.txt	…
kernel-parameters.txt	drivers/char/hpet.c: allow user controlled mmap for user processes	2013-11-13 12:09:11 +09:00
kernel-per-CPU-kthreads.txt	kthread: Add pointer to vmstat-avoidance patch	2013-09-25 06:49:46 -07:00
kmemcheck.txt	Documentation/kmemcheck: update kmemcheck documentation	2013-08-27 10:47:05 +02:00
kmemleak.txt	…
kobject.txt	…
kprobes.txt	…
kref.txt	…
ldm.txt	…
local_ops.txt	…
lockdep-design.txt	…
lockstat.txt	…
lockup-watchdogs.txt	…
logo.gif	…
logo.txt	…
magic-number.txt	…
md.txt	…
media-framework.txt	…
memory-barriers.txt	…
memory-hotplug.txt	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial	2013-09-06 09:36:28 -07:00
mono.txt	…
mutex-design.txt	…
nommu-mmap.txt	…
numastat.txt	…
oops-tracing.txt	…
padata.txt	…
parport-lowlevel.txt	…
parport.txt	…
percpu-rw-semaphore.txt	…
phy.txt	drivers: phy: add generic PHY framework	2013-09-27 17:35:41 -07:00
pi-futex.txt	…
pinctrl.txt	pinctrl: add documentation for pinctrl_get_group_pins()	2013-10-16 15:35:21 +02:00
pnp.txt	…
preempt-locking.txt	…
printk-formats.txt	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial	2013-09-06 09:36:28 -07:00
pwm.txt	…
ramoops.txt	…
rbtree.txt	…
remoteproc.txt	…
rfkill.txt	…
robust-futex-ABI.txt	…
robust-futexes.txt	…
rpmsg.txt	…
rt-mutex-design.txt	…
rt-mutex.txt	…
rtc.txt	…
serial-console.txt	…
sgi-ioc4.txt	…
sgi-visws.txt	…
smsc_ece1099.txt	…
sparse.txt	…
spinlocks.txt	…
stable_api_nonsense.txt	…
stable_kernel_rules.txt	…
static-keys.txt	…
svga.txt	…
sysfs-rules.txt	…
sysrq.txt	sysrq: Allow magic SysRq key functions to be disabled through Kconfig	2013-10-16 13:01:44 -07:00
this_cpu_ops.txt	…
unaligned-memory-access.txt	…
unicode.txt	…
unshare.txt	…
vfio.txt	vfio: fix documentation	2013-09-05 16:36:21 -06:00
vgaarbiter.txt	…
video-output.txt	…
vme_api.txt	…
volatile-considered-harmful.txt	…
workqueue.txt	…
ww-mutex-design.txt	…
xz.txt	…
zorro.txt	…