From owner-dev-commits-src-all@freebsd.org Sun Jun 6 19:25:52 2021 Return-Path: Delivered-To: dev-commits-src-all@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id 9F56063C0B7; Sun, 6 Jun 2021 19:25:52 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4Fymgh42q2z3mdM; Sun, 6 Jun 2021 19:25:52 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 63E1D110A; Sun, 6 Jun 2021 19:25:52 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.16.1/8.16.1) with ESMTP id 156JPqtj045054; Sun, 6 Jun 2021 19:25:52 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.16.1/8.16.1/Submit) id 156JPqB7045053; Sun, 6 Jun 2021 19:25:52 GMT (envelope-from git) Date: Sun, 6 Jun 2021 19:25:52 GMT Message-Id: <202106061925.156JPqB7045053@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Konstantin Belousov Subject: git: 598f6fb49c9c - main - linuxolator: Add compat.linux.setid_allowed knob MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: kib X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 598f6fb49c9ca688029b79de0a44227ab79c608c Auto-Submitted: auto-generated X-BeenThere: dev-commits-src-all@freebsd.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: Commit messages for all branches of the src repository List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 06 Jun 2021 19:25:52 -0000 The branch main has been updated by kib: URL: https://cgit.FreeBSD.org/src/commit/?id=598f6fb49c9ca688029b79de0a44227ab79c608c commit 598f6fb49c9ca688029b79de0a44227ab79c608c Author: Konstantin Belousov AuthorDate: 2021-01-14 13:51:52 +0000 Commit: Konstantin Belousov CommitDate: 2021-06-06 18:43:00 +0000 linuxolator: Add compat.linux.setid_allowed knob PR: 21463 Reported by: kris Reviewed by: dchagin Tested by: trasz Sponsored by: The FreeBSD Foundation MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D28154 --- share/man/man4/linux.4 | 14 +++++++++++++- sys/amd64/linux/linux_sysvec.c | 1 + sys/amd64/linux32/linux32_sysvec.c | 1 + sys/arm64/linux/linux_sysvec.c | 1 + sys/compat/linux/linux_mib.c | 12 ++++++++++++ sys/compat/linux/linux_mib.h | 3 +++ sys/i386/linux/linux_sysvec.c | 2 ++ 7 files changed, 33 insertions(+), 1 deletion(-) diff --git a/share/man/man4/linux.4 b/share/man/man4/linux.4 index 23bc0c26f7f9..b2d36158c622 100644 --- a/share/man/man4/linux.4 +++ b/share/man/man4/linux.4 @@ -24,7 +24,7 @@ .\" .\" $FreeBSD$ .\" -.Dd July 5, 2020 +.Dd May 6, 2021 .Dt LINUX 4 .Os .Sh NAME @@ -130,6 +130,18 @@ From a user perspective, this makes .Va SIGINFO work for Linux executables. Defaults to 0. +.It Va compat.linux.setid_allowed +Disable handling of set-user-ID and set-group-ID mode bits for the new +process image file when image is to be executed under Linux ABI. +When set, new Linux images always use credentials of the program +that issued +.Xr execve 2 +call, regardless of the image file mode. +.Pp +This might be reasonable or even required, because +.Fx +does not emulate Linux environment completely, and missed features +could become holes. .El .Sh FILES .Bl -tag -width /compat/linux/dev/shm -compact diff --git a/sys/amd64/linux/linux_sysvec.c b/sys/amd64/linux/linux_sysvec.c index 02225e63072d..3eab9126f192 100644 --- a/sys/amd64/linux/linux_sysvec.c +++ b/sys/amd64/linux/linux_sysvec.c @@ -764,6 +764,7 @@ struct sysentvec elf_linux_sysvec = { .sv_onexec = linux_on_exec, .sv_onexit = linux_on_exit, .sv_ontdexit = linux_thread_dtor, + .sv_setid_allowed = &linux_setid_allowed_query, }; static void diff --git a/sys/amd64/linux32/linux32_sysvec.c b/sys/amd64/linux32/linux32_sysvec.c index 05354803cf03..b950c00eba1d 100644 --- a/sys/amd64/linux32/linux32_sysvec.c +++ b/sys/amd64/linux32/linux32_sysvec.c @@ -931,6 +931,7 @@ struct sysentvec elf_linux_sysvec = { .sv_onexec = linux_on_exec, .sv_onexit = linux_on_exit, .sv_ontdexit = linux_thread_dtor, + .sv_setid_allowed = &linux_setid_allowed_query, }; static void diff --git a/sys/arm64/linux/linux_sysvec.c b/sys/arm64/linux/linux_sysvec.c index 365cb9fc386a..57abdc6fd691 100644 --- a/sys/arm64/linux/linux_sysvec.c +++ b/sys/arm64/linux/linux_sysvec.c @@ -443,6 +443,7 @@ struct sysentvec elf_linux_sysvec = { .sv_onexec = linux_on_exec, .sv_onexit = linux_on_exit, .sv_ontdexit = linux_thread_dtor, + .sv_setid_allowed = &linux_setid_allowed_query, }; static void diff --git a/sys/compat/linux/linux_mib.c b/sys/compat/linux/linux_mib.c index cc4207f74a39..3a6627df9abd 100644 --- a/sys/compat/linux/linux_mib.c +++ b/sys/compat/linux/linux_mib.c @@ -99,6 +99,18 @@ int linux_use_emul_path = 1; SYSCTL_INT(_compat_linux, OID_AUTO, use_emul_path, CTLFLAG_RWTUN, &linux_use_emul_path, 0, "Use linux.compat.emul_path"); +static bool linux_setid_allowed = true; +SYSCTL_BOOL(_compat_linux, OID_AUTO, setid_allowed, CTLFLAG_RWTUN, + &linux_setid_allowed, 0, + "Allow setuid/setgid on execve of Linux binary"); + +bool +linux_setid_allowed_query(struct thread *td __unused, + struct image_params *imgp __unused) +{ + return (linux_setid_allowed); +} + static int linux_set_osname(struct thread *td, char *osname); static int linux_set_osrelease(struct thread *td, char *osrelease); static int linux_set_oss_version(struct thread *td, int oss_version); diff --git a/sys/compat/linux/linux_mib.h b/sys/compat/linux/linux_mib.h index c4d3d1e83f7e..adf71cb65401 100644 --- a/sys/compat/linux/linux_mib.h +++ b/sys/compat/linux/linux_mib.h @@ -71,4 +71,7 @@ extern int linux_ignore_ip_recverr; extern int linux_preserve_vstatus; extern bool linux_map_sched_prio; +struct image_params; +bool linux_setid_allowed_query(struct thread *td, struct image_params *imgp); + #endif /* _LINUX_MIB_H_ */ diff --git a/sys/i386/linux/linux_sysvec.c b/sys/i386/linux/linux_sysvec.c index 0e6ad4b5c137..9cc1a723ab55 100644 --- a/sys/i386/linux/linux_sysvec.c +++ b/sys/i386/linux/linux_sysvec.c @@ -871,6 +871,7 @@ struct sysentvec linux_sysvec = { .sv_onexec = linux_on_exec, .sv_onexit = linux_on_exit, .sv_ontdexit = linux_thread_dtor, + .sv_setid_allowed = &linux_setid_allowed_query, }; INIT_SYSENTVEC(aout_sysvec, &linux_sysvec); @@ -908,6 +909,7 @@ struct sysentvec elf_linux_sysvec = { .sv_onexec = linux_on_exec, .sv_onexit = linux_on_exit, .sv_ontdexit = linux_thread_dtor, + .sv_setid_allowed = &linux_setid_allowed_query, }; static void