reference by pointer 0x00000018 ntoskrnl.exe

Normally a process with CAP_SETUID can become any user on the system, including root, which makes it a meaningless capability to hand out to non-root users in order for them to “drop privileges” to some less powerful user. Micah Morton added the new SafeSetID LSM, which provides a way to narrow the power associated with the CAP_SETUID capability. Yama, LoadPin) which could already stack because they didn’t need blob storage. This unblocks the way for “medium sized” LSMs (like SARA and Landlock) to get stacked with a “major” LSM as they need to store much more state than the “minor” LSMs (e.g. With “shared” security blobs, the LSM infrastructure does the allocation and management of the memory, and LSMs use an offset for reading/writing their portion of it. SELinux, Apprmor, etc) full control over the entire blob of storage. The kernel originally gave only the single active “major” LSM (e.g. storing which profile a given task confined under). inodes, tasks, etc) that LSMs can use for saving their state (e.g. It is now possible for LSMs to share the security-specific storage “blobs”associated with various core structures (e.g. The latter check almost immediately caught a bad case, which was quickly fixed to avoid page type corruption.Ĭasey Shaufler has landed one of the major pieces of getting multiple Linux Security Modules (LSMs) running at the same time (called “stacking”). To quote the commit logs: “It’s never appropriate to map a page allocated by SLAB into userspace” and “Pages which use page_type must never be mapped to userspace as it would destroy their page type”. Driver bugs or attackers able to confuse mappings wouldn’t get caught, so he added checks.

(BTW, this commit wins the 2019 award for Most Well Documented Commit Log Justification.)Įxplicitly test for userspace mappings of heap memoryĭuring Linux Conf AU 2019 Kernel Hardening BoF, Matthew Wilcox noted that there wasn’t anything in the kernel actually sanity-checking when userspace mappings were being applied to kernel heap memory (which would allow attackers to bypass the copy_user() infrastructure). Using this method, it’s now possible to racelessly send signals to exactly the intended process without having to worry about pid reuse. This handle will only refer to the original process at the time the open() happened, and not to any later “reused” pid if the process dies and a new process is assigned the same pid. Now /proc/$pid can be opened and used as an argument for sending signals with the new pidfd_send_signal() syscall. Linux kernel v5.1 has been released! Here are some security-related things that stood out to me:Ĭhristian Brauner landed the first portion of his work to remove pid races from the kernel: using a file descriptor to reference a process (“pidfd”).

Reference by pointer 0x00000018 ntoskrnl.exe