Commit 9f834ec1 authored by Linus Torvalds's avatar Linus Torvalds

binfmt_elf: switch to new creds when switching to new mm

We used to delay switching to the new credentials until after we had
mapped the executable (and possible elf interpreter).  That was kind of
odd to begin with, since the new executable will actually then _run_
with the new creds, but whatever.

The bigger problem was that we also want to make sure that we turn off
prof events and tracing before we start mapping the new executable
state.  So while this is a cleanup, it's also a fix for a possible
information leak.
Reported-by: default avatarRobert Święcki <robert@swiecki.net>
Tested-by: default avatarPeter Zijlstra <peterz@infradead.org>
Acked-by: default avatarDavid Howells <dhowells@redhat.com>
Acked-by: default avatarOleg Nesterov <oleg@redhat.com>
Acked-by: default avatarAndy Lutomirski <luto@amacapital.net>
Acked-by: default avatarEric W. Biederman <ebiederm@xmission.com>
Cc: Willy Tarreau <w@1wt.eu>
Cc: Kees Cook <keescook@chromium.org>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent 61b5ebd6
...@@ -853,6 +853,7 @@ static int load_elf_binary(struct linux_binprm *bprm) ...@@ -853,6 +853,7 @@ static int load_elf_binary(struct linux_binprm *bprm)
current->flags |= PF_RANDOMIZE; current->flags |= PF_RANDOMIZE;
setup_new_exec(bprm); setup_new_exec(bprm);
install_exec_creds(bprm);
/* Do this so that we can load the interpreter, if need be. We will /* Do this so that we can load the interpreter, if need be. We will
change some of these later */ change some of these later */
...@@ -1044,7 +1045,6 @@ static int load_elf_binary(struct linux_binprm *bprm) ...@@ -1044,7 +1045,6 @@ static int load_elf_binary(struct linux_binprm *bprm)
goto out; goto out;
#endif /* ARCH_HAS_SETUP_ADDITIONAL_PAGES */ #endif /* ARCH_HAS_SETUP_ADDITIONAL_PAGES */
install_exec_creds(bprm);
retval = create_elf_tables(bprm, &loc->elf_ex, retval = create_elf_tables(bprm, &loc->elf_ex,
load_addr, interp_load_addr); load_addr, interp_load_addr);
if (retval < 0) if (retval < 0)
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment