summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorJosh Boyer <jwboyer@fedoraproject.org>2014-06-17 17:22:51 -0400
committerJosh Boyer <jwboyer@fedoraproject.org>2014-06-17 17:22:51 -0400
commit8fc448b27e81f67cd57d668246c5e82e9381377c (patch)
tree0dfee65ce3e4d9090000dc4169ea087c89abfe3a
parent7c02a3a60c04e7332b43570873544a0f7c8da94e (diff)
downloadkernel-8fc448b27e81f67cd57d668246c5e82e9381377c.tar.gz
kernel-8fc448b27e81f67cd57d668246c5e82e9381377c.tar.xz
kernel-8fc448b27e81f67cd57d668246c5e82e9381377c.zip
Linux v3.15.1
-rw-r--r--auditsc-audit_krule-mask-accesses-need-bounds-checking.patch128
-rw-r--r--fs-userns-Change-inode_capable-to-capable_wrt_inode_.patch209
-rw-r--r--kernel.spec17
-rw-r--r--sources1
4 files changed, 5 insertions, 350 deletions
diff --git a/auditsc-audit_krule-mask-accesses-need-bounds-checking.patch b/auditsc-audit_krule-mask-accesses-need-bounds-checking.patch
deleted file mode 100644
index 1a7763767..000000000
--- a/auditsc-audit_krule-mask-accesses-need-bounds-checking.patch
+++ /dev/null
@@ -1,128 +0,0 @@
-Bugzilla: 1102715
-Upstream-status: Submitted for 3.15 and CC'd to stable
-Delivered-To: jwboyer@gmail.com
-Received: by 10.76.6.212 with SMTP id d20csp285523oaa;
- Wed, 28 May 2014 20:10:58 -0700 (PDT)
-X-Received: by 10.66.250.166 with SMTP id zd6mr4872927pac.7.1401333057574;
- Wed, 28 May 2014 20:10:57 -0700 (PDT)
-Return-Path: <stable-owner@vger.kernel.org>
-Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67])
- by mx.google.com with ESMTP id j1si26042371pbw.214.2014.05.28.20.10.31
- for <multiple recipients>;
- Wed, 28 May 2014 20:10:57 -0700 (PDT)
-Received-SPF: none (google.com: stable-owner@vger.kernel.org does not designate permitted sender hosts) client-ip=209.132.180.67;
-Authentication-Results: mx.google.com;
- spf=neutral (google.com: stable-owner@vger.kernel.org does not designate permitted sender hosts) smtp.mail=stable-owner@vger.kernel.org
-Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
- id S1755059AbaE2DKa (ORCPT <rfc822;takashi.bg@gmail.com>
- + 73 others); Wed, 28 May 2014 23:10:30 -0400
-Received: from mx1.redhat.com ([209.132.183.28]:34907 "EHLO mx1.redhat.com"
- rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP
- id S1753861AbaE2DK3 (ORCPT <rfc822;stable@vger.kernel.org>);
- Wed, 28 May 2014 23:10:29 -0400
-Received: from int-mx13.intmail.prod.int.phx2.redhat.com (int-mx13.intmail.prod.int.phx2.redhat.com [10.5.11.26])
- by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id s4T3AQfK017267
- (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK);
- Wed, 28 May 2014 23:10:26 -0400
-Received: from paris.rdu.redhat.com (paris.rdu.redhat.com [10.13.136.28])
- by int-mx13.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id s4T3APd7019240;
- Wed, 28 May 2014 23:10:26 -0400
-From: Eric Paris <eparis@redhat.com>
-To: torvalds@linux-foundation.org
-Cc: linux-audit@redhat.com, linux-kernel@vger.kernel.org,
- Andy Lutomirski <luto@amacapital.net>, stable@vger.kernel.org,
- Eric Paris <eparis@redhat.com>
-Subject: [PATCH 1/2] auditsc: audit_krule mask accesses need bounds checking
-Date: Wed, 28 May 2014 23:09:58 -0400
-Message-Id: <1401332999-15167-1-git-send-email-eparis@redhat.com>
-X-Scanned-By: MIMEDefang 2.68 on 10.5.11.26
-Sender: stable-owner@vger.kernel.org
-Precedence: bulk
-List-ID: <stable.vger.kernel.org>
-X-Mailing-List: stable@vger.kernel.org
-
-From: Andy Lutomirski <luto@amacapital.net>
-
-Fixes an easy DoS and possible information disclosure.
-
-This does nothing about the broken state of x32 auditing.
-
-eparis: If the admin has enabled auditd and has specifically loaded audit
-rules. This bug has been around since before git. Wow...
-
-Cc: stable@vger.kernel.org
-Signed-off-by: Andy Lutomirski <luto@amacapital.net>
-Signed-off-by: Eric Paris <eparis@redhat.com>
----
- kernel/auditsc.c | 27 ++++++++++++++++++---------
- 1 file changed, 18 insertions(+), 9 deletions(-)
-
-diff --git a/kernel/auditsc.c b/kernel/auditsc.c
-index 254ce20..842f58a 100644
---- a/kernel/auditsc.c
-+++ b/kernel/auditsc.c
-@@ -728,6 +728,22 @@ static enum audit_state audit_filter_task(struct task_struct *tsk, char **key)
- return AUDIT_BUILD_CONTEXT;
- }
-
-+static int audit_in_mask(const struct audit_krule *rule, unsigned long val)
-+{
-+ int word, bit;
-+
-+ if (val > 0xffffffff)
-+ return false;
-+
-+ word = AUDIT_WORD(val);
-+ if (word >= AUDIT_BITMASK_SIZE)
-+ return false;
-+
-+ bit = AUDIT_BIT(val);
-+
-+ return rule->mask[word] & bit;
-+}
-+
- /* At syscall entry and exit time, this filter is called if the
- * audit_state is not low enough that auditing cannot take place, but is
- * also not high enough that we already know we have to write an audit
-@@ -745,11 +761,8 @@ static enum audit_state audit_filter_syscall(struct task_struct *tsk,
-
- rcu_read_lock();
- if (!list_empty(list)) {
-- int word = AUDIT_WORD(ctx->major);
-- int bit = AUDIT_BIT(ctx->major);
--
- list_for_each_entry_rcu(e, list, list) {
-- if ((e->rule.mask[word] & bit) == bit &&
-+ if (audit_in_mask(&e->rule, ctx->major) &&
- audit_filter_rules(tsk, &e->rule, ctx, NULL,
- &state, false)) {
- rcu_read_unlock();
-@@ -769,20 +782,16 @@ static enum audit_state audit_filter_syscall(struct task_struct *tsk,
- static int audit_filter_inode_name(struct task_struct *tsk,
- struct audit_names *n,
- struct audit_context *ctx) {
-- int word, bit;
- int h = audit_hash_ino((u32)n->ino);
- struct list_head *list = &audit_inode_hash[h];
- struct audit_entry *e;
- enum audit_state state;
-
-- word = AUDIT_WORD(ctx->major);
-- bit = AUDIT_BIT(ctx->major);
--
- if (list_empty(list))
- return 0;
-
- list_for_each_entry_rcu(e, list, list) {
-- if ((e->rule.mask[word] & bit) == bit &&
-+ if (audit_in_mask(&e->rule, ctx->major) &&
- audit_filter_rules(tsk, &e->rule, ctx, n, &state, false)) {
- ctx->current_state = state;
- return 1;
---
-1.9.0
-
---
-To unsubscribe from this list: send the line "unsubscribe stable" in
-the body of a message to majordomo@vger.kernel.org
-More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/fs-userns-Change-inode_capable-to-capable_wrt_inode_.patch b/fs-userns-Change-inode_capable-to-capable_wrt_inode_.patch
deleted file mode 100644
index b56e7171a..000000000
--- a/fs-userns-Change-inode_capable-to-capable_wrt_inode_.patch
+++ /dev/null
@@ -1,209 +0,0 @@
-Bugzilla: 1109836
-Upstream-status: 3.16-rc1 and CC'd to stable
-
-From 23adbe12ef7d3d4195e80800ab36b37bee28cd03 Mon Sep 17 00:00:00 2001
-From: Andy Lutomirski <luto@amacapital.net>
-Date: Tue, 10 Jun 2014 12:45:42 -0700
-Subject: [PATCH] fs,userns: Change inode_capable to capable_wrt_inode_uidgid
-
-The kernel has no concept of capabilities with respect to inodes; inodes
-exist independently of namespaces. For example, inode_capable(inode,
-CAP_LINUX_IMMUTABLE) would be nonsense.
-
-This patch changes inode_capable to check for uid and gid mappings and
-renames it to capable_wrt_inode_uidgid, which should make it more
-obvious what it does.
-
-Fixes CVE-2014-4014.
-
-Cc: Theodore Ts'o <tytso@mit.edu>
-Cc: Serge Hallyn <serge.hallyn@ubuntu.com>
-Cc: "Eric W. Biederman" <ebiederm@xmission.com>
-Cc: Dave Chinner <david@fromorbit.com>
-Cc: stable@vger.kernel.org
-Signed-off-by: Andy Lutomirski <luto@amacapital.net>
-Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
----
- fs/attr.c | 8 ++++----
- fs/inode.c | 10 +++++++---
- fs/namei.c | 11 ++++++-----
- fs/xfs/xfs_ioctl.c | 2 +-
- include/linux/capability.h | 2 +-
- kernel/capability.c | 20 ++++++++------------
- 6 files changed, 27 insertions(+), 26 deletions(-)
-
-diff --git a/fs/attr.c b/fs/attr.c
-index 5d4e59d..6530ced 100644
---- a/fs/attr.c
-+++ b/fs/attr.c
-@@ -50,14 +50,14 @@ int inode_change_ok(const struct inode *inode, struct iattr *attr)
- if ((ia_valid & ATTR_UID) &&
- (!uid_eq(current_fsuid(), inode->i_uid) ||
- !uid_eq(attr->ia_uid, inode->i_uid)) &&
-- !inode_capable(inode, CAP_CHOWN))
-+ !capable_wrt_inode_uidgid(inode, CAP_CHOWN))
- return -EPERM;
-
- /* Make sure caller can chgrp. */
- if ((ia_valid & ATTR_GID) &&
- (!uid_eq(current_fsuid(), inode->i_uid) ||
- (!in_group_p(attr->ia_gid) && !gid_eq(attr->ia_gid, inode->i_gid))) &&
-- !inode_capable(inode, CAP_CHOWN))
-+ !capable_wrt_inode_uidgid(inode, CAP_CHOWN))
- return -EPERM;
-
- /* Make sure a caller can chmod. */
-@@ -67,7 +67,7 @@ int inode_change_ok(const struct inode *inode, struct iattr *attr)
- /* Also check the setgid bit! */
- if (!in_group_p((ia_valid & ATTR_GID) ? attr->ia_gid :
- inode->i_gid) &&
-- !inode_capable(inode, CAP_FSETID))
-+ !capable_wrt_inode_uidgid(inode, CAP_FSETID))
- attr->ia_mode &= ~S_ISGID;
- }
-
-@@ -160,7 +160,7 @@ void setattr_copy(struct inode *inode, const struct iattr *attr)
- umode_t mode = attr->ia_mode;
-
- if (!in_group_p(inode->i_gid) &&
-- !inode_capable(inode, CAP_FSETID))
-+ !capable_wrt_inode_uidgid(inode, CAP_FSETID))
- mode &= ~S_ISGID;
- inode->i_mode = mode;
- }
-diff --git a/fs/inode.c b/fs/inode.c
-index 2feb9b6..6eecb7f 100644
---- a/fs/inode.c
-+++ b/fs/inode.c
-@@ -1839,14 +1839,18 @@ EXPORT_SYMBOL(inode_init_owner);
- * inode_owner_or_capable - check current task permissions to inode
- * @inode: inode being checked
- *
-- * Return true if current either has CAP_FOWNER to the inode, or
-- * owns the file.
-+ * Return true if current either has CAP_FOWNER in a namespace with the
-+ * inode owner uid mapped, or owns the file.
- */
- bool inode_owner_or_capable(const struct inode *inode)
- {
-+ struct user_namespace *ns;
-+
- if (uid_eq(current_fsuid(), inode->i_uid))
- return true;
-- if (inode_capable(inode, CAP_FOWNER))
-+
-+ ns = current_user_ns();
-+ if (ns_capable(ns, CAP_FOWNER) && kuid_has_mapping(ns, inode->i_uid))
- return true;
- return false;
- }
-diff --git a/fs/namei.c b/fs/namei.c
-index 8016827..985c6f3 100644
---- a/fs/namei.c
-+++ b/fs/namei.c
-@@ -332,10 +332,11 @@ int generic_permission(struct inode *inode, int mask)
-
- if (S_ISDIR(inode->i_mode)) {
- /* DACs are overridable for directories */
-- if (inode_capable(inode, CAP_DAC_OVERRIDE))
-+ if (capable_wrt_inode_uidgid(inode, CAP_DAC_OVERRIDE))
- return 0;
- if (!(mask & MAY_WRITE))
-- if (inode_capable(inode, CAP_DAC_READ_SEARCH))
-+ if (capable_wrt_inode_uidgid(inode,
-+ CAP_DAC_READ_SEARCH))
- return 0;
- return -EACCES;
- }
-@@ -345,7 +346,7 @@ int generic_permission(struct inode *inode, int mask)
- * at least one exec bit set.
- */
- if (!(mask & MAY_EXEC) || (inode->i_mode & S_IXUGO))
-- if (inode_capable(inode, CAP_DAC_OVERRIDE))
-+ if (capable_wrt_inode_uidgid(inode, CAP_DAC_OVERRIDE))
- return 0;
-
- /*
-@@ -353,7 +354,7 @@ int generic_permission(struct inode *inode, int mask)
- */
- mask &= MAY_READ | MAY_WRITE | MAY_EXEC;
- if (mask == MAY_READ)
-- if (inode_capable(inode, CAP_DAC_READ_SEARCH))
-+ if (capable_wrt_inode_uidgid(inode, CAP_DAC_READ_SEARCH))
- return 0;
-
- return -EACCES;
-@@ -2379,7 +2380,7 @@ static inline int check_sticky(struct inode *dir, struct inode *inode)
- return 0;
- if (uid_eq(dir->i_uid, fsuid))
- return 0;
-- return !inode_capable(inode, CAP_FOWNER);
-+ return !capable_wrt_inode_uidgid(inode, CAP_FOWNER);
- }
-
- /*
-diff --git a/fs/xfs/xfs_ioctl.c b/fs/xfs/xfs_ioctl.c
-index 0b18776..6152cbe 100644
---- a/fs/xfs/xfs_ioctl.c
-+++ b/fs/xfs/xfs_ioctl.c
-@@ -1215,7 +1215,7 @@ xfs_ioctl_setattr(
- * cleared upon successful return from chown()
- */
- if ((ip->i_d.di_mode & (S_ISUID|S_ISGID)) &&
-- !inode_capable(VFS_I(ip), CAP_FSETID))
-+ !capable_wrt_inode_uidgid(VFS_I(ip), CAP_FSETID))
- ip->i_d.di_mode &= ~(S_ISUID|S_ISGID);
-
- /*
-diff --git a/include/linux/capability.h b/include/linux/capability.h
-index a6ee1f9..84b13ad 100644
---- a/include/linux/capability.h
-+++ b/include/linux/capability.h
-@@ -210,7 +210,7 @@ extern bool has_ns_capability_noaudit(struct task_struct *t,
- struct user_namespace *ns, int cap);
- extern bool capable(int cap);
- extern bool ns_capable(struct user_namespace *ns, int cap);
--extern bool inode_capable(const struct inode *inode, int cap);
-+extern bool capable_wrt_inode_uidgid(const struct inode *inode, int cap);
- extern bool file_ns_capable(const struct file *file, struct user_namespace *ns, int cap);
-
- /* audit system wants to get cap info from files as well */
-diff --git a/kernel/capability.c b/kernel/capability.c
-index 84b2bbf..a5cf13c 100644
---- a/kernel/capability.c
-+++ b/kernel/capability.c
-@@ -424,23 +424,19 @@ bool capable(int cap)
- EXPORT_SYMBOL(capable);
-
- /**
-- * inode_capable - Check superior capability over inode
-+ * capable_wrt_inode_uidgid - Check nsown_capable and uid and gid mapped
- * @inode: The inode in question
- * @cap: The capability in question
- *
-- * Return true if the current task has the given superior capability
-- * targeted at it's own user namespace and that the given inode is owned
-- * by the current user namespace or a child namespace.
-- *
-- * Currently we check to see if an inode is owned by the current
-- * user namespace by seeing if the inode's owner maps into the
-- * current user namespace.
-- *
-+ * Return true if the current task has the given capability targeted at
-+ * its own user namespace and that the given inode's uid and gid are
-+ * mapped into the current user namespace.
- */
--bool inode_capable(const struct inode *inode, int cap)
-+bool capable_wrt_inode_uidgid(const struct inode *inode, int cap)
- {
- struct user_namespace *ns = current_user_ns();
-
-- return ns_capable(ns, cap) && kuid_has_mapping(ns, inode->i_uid);
-+ return ns_capable(ns, cap) && kuid_has_mapping(ns, inode->i_uid) &&
-+ kgid_has_mapping(ns, inode->i_gid);
- }
--EXPORT_SYMBOL(inode_capable);
-+EXPORT_SYMBOL(capable_wrt_inode_uidgid);
---
-1.9.3
-
diff --git a/kernel.spec b/kernel.spec
index 6b007f133..0d7c91371 100644
--- a/kernel.spec
+++ b/kernel.spec
@@ -74,7 +74,7 @@ Summary: The Linux kernel
%if 0%{?released_kernel}
# Do we have a -stable update to apply?
-%define stable_update 0
+%define stable_update 1
# Is it a -stable RC?
%define stable_rc 0
# Set rpm version accordingly
@@ -703,9 +703,6 @@ Patch25069: 0001-acpi-video-Add-4-new-models-to-the-use_native_backli.patch
Patch25071: s390-appldata-add-slab.h-for-kzalloc-kfree.patch
-# CVE-2014-3917 rhbz 1102571 1102715
-Patch25093: auditsc-audit_krule-mask-accesses-need-bounds-checking.patch
-
# Patch series from Hans for various backlight and platform driver fixes
Patch26001: thinkpad_acpi-Add-mappings-for-F9-F12-hotkeys-on-X24.patch
Patch26002: samsung-laptop-Add-broken-acpi-video-quirk-for-NC210.patch
@@ -737,9 +734,6 @@ Patch25100: dm-thin-update-discard_granularity-to-reflect-the-thin-pool-blocksiz
#rhbz 1103528
Patch25101: elantech-Deal-with-clickpads-reporting-right-button-.patch
-#CVE-2014-4014 rhbz 1107966 1109836
-Patch25102: fs-userns-Change-inode_capable-to-capable_wrt_inode_.patch
-
# END OF PATCH DEFINITIONS
%endif
@@ -1411,9 +1405,6 @@ ApplyPatch 0001-acpi-video-Add-4-new-models-to-the-use_native_backli.patch
ApplyPatch s390-appldata-add-slab.h-for-kzalloc-kfree.patch
-# CVE-2014-3917 rhbz 1102571 1102715
-ApplyPatch auditsc-audit_krule-mask-accesses-need-bounds-checking.patch
-
# Patch series from Hans for various backlight and platform driver fixes
ApplyPatch thinkpad_acpi-Add-mappings-for-F9-F12-hotkeys-on-X24.patch
ApplyPatch samsung-laptop-Add-broken-acpi-video-quirk-for-NC210.patch
@@ -1445,9 +1436,6 @@ ApplyPatch dm-thin-update-discard_granularity-to-reflect-the-thin-pool-blocksize
#rhbz 1103528
ApplyPatch elantech-Deal-with-clickpads-reporting-right-button-.patch
-#CVE-2014-4014 rhbz 1107966 1109836
-ApplyPatch fs-userns-Change-inode_capable-to-capable_wrt_inode_.patch
-
# END OF PATCH APPLICATIONS
%endif
@@ -2260,6 +2248,9 @@ fi
# ||----w |
# || ||
%changelog
+* Tue Jun 17 2014 Josh Boyer <jwboyer@fedoraproject.org>
+- Linux v3.15.1
+
* Mon Jun 16 2014 Josh Boyer <jwboyer@fedoraproject.org>
- CVE-2014-4014 possible priv escalation in userns (rhbz 1107966 1109836)
diff --git a/sources b/sources
index b0282682e..87571d2d3 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,3 @@
97ca1625bb40368dc41b9a7971549071 linux-3.15.tar.xz
ef8f4db937f521a7e323ec589536ba25 perf-man-3.15.tar.gz
+78a944411af297b9e5e9aa430056de4c patch-3.15.1.xz