• Vasiliy Kulikov's avatar
    move RLIMIT_NPROC check from set_user() to do_execve_common() · 72fa5997
    Vasiliy Kulikov authored
    The patch http://lkml.org/lkml/2003/7/13/226 introduced an RLIMIT_NPROC
    check in set_user() to check for NPROC exceeding via setuid() and
    similar functions.
    
    Before the check there was a possibility to greatly exceed the allowed
    number of processes by an unprivileged user if the program relied on
    rlimit only.  But the check created new security threat: many poorly
    written programs simply don't check setuid() return code and believe it
    cannot fail if executed with root privileges.  So, the check is removed
    in this patch because of too often privilege escalations related to
    buggy programs.
    
    The NPROC can still be enforced in the common code flow of daemons
    spawning user processes.  Most of daemons do fork()+setuid()+execve().
    The check introduced in execve() (1) enforces the same limit as in
    setuid() and (2) doesn't create similar security issues.
    
    Neil Brown suggested to track what specific process has exceeded the
    limit by setting PF_NPROC_EXCEEDED process flag.  With the change only
    this process would fail on execve(), and other processes' execve()
    behaviour is not changed.
    
    Solar Designer suggested to re-check whether NPROC limit is still
    exceeded at the moment of execve().  If the process was sleeping for
    days between set*uid() and execve(), and the NPROC counter step down
    under the limit, the defered execve() failure because NPROC limit was
    exceeded days ago would be unexpected.  If the limit is not exceeded
    anymore, we clear the flag on successful calls to execve() and fork().
    
    The flag is also cleared on successful calls to set_user() as the limit
    was exceeded for the previous user, not the current one.
    
    Similar check was introduced in -ow patches (without the process flag).
    
    v3 - clear PF_NPROC_EXCEEDED on successful calls to set_user().
    Reviewed-by: default avatarJames Morris <jmorris@namei.org>
    Signed-off-by: default avatarVasiliy Kulikov <segoon@openwall.com>
    Acked-by: default avatarNeilBrown <neilb@suse.de>
    Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
    72fa5997
cred.c 21.8 KB