Skip to content

Commit 22f6b4d

Browse files
thejhtorvalds
authored andcommitted
aio: mark AIO pseudo-fs noexec
This ensures that do_mmap() won't implicitly make AIO memory mappings executable if the READ_IMPLIES_EXEC personality flag is set. Such behavior is problematic because the security_mmap_file LSM hook doesn't catch this case, potentially permitting an attacker to bypass a W^X policy enforced by SELinux. I have tested the patch on my machine. To test the behavior, compile and run this: #define _GNU_SOURCE #include <unistd.h> #include <sys/personality.h> #include <linux/aio_abi.h> #include <err.h> #include <stdlib.h> #include <stdio.h> #include <sys/syscall.h> int main(void) { personality(READ_IMPLIES_EXEC); aio_context_t ctx = 0; if (syscall(__NR_io_setup, 1, &ctx)) err(1, "io_setup"); char cmd[1000]; sprintf(cmd, "cat /proc/%d/maps | grep -F '/[aio]'", (int)getpid()); system(cmd); return 0; } In the output, "rw-s" is good, "rwxs" is bad. Signed-off-by: Jann Horn <jann@thejh.net> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
1 parent 024c7e3 commit 22f6b4d

File tree

1 file changed

+6
-1
lines changed

1 file changed

+6
-1
lines changed

Diff for: fs/aio.c

+6-1
Original file line numberDiff line numberDiff line change
@@ -239,7 +239,12 @@ static struct dentry *aio_mount(struct file_system_type *fs_type,
239239
static const struct dentry_operations ops = {
240240
.d_dname = simple_dname,
241241
};
242-
return mount_pseudo(fs_type, "aio:", NULL, &ops, AIO_RING_MAGIC);
242+
struct dentry *root = mount_pseudo(fs_type, "aio:", NULL, &ops,
243+
AIO_RING_MAGIC);
244+
245+
if (!IS_ERR(root))
246+
root->d_sb->s_iflags |= SB_I_NOEXEC;
247+
return root;
243248
}
244249

245250
/* aio_setup

0 commit comments

Comments
 (0)