[RFC v2 07/10] landlock: Add errno check
From: Mickaël Salaün <mic@digikod.net>
Date: 2016-08-25 10:45:53
Also in:
lkml, netdev
Subsystem:
generic include/asm header files, landlock security module, security subsystem, the rest · Maintainers:
Arnd Bergmann, Mickaël Salaün, Paul Moore, James Morris, "Serge E. Hallyn", Linus Torvalds
Add a max errno value. This is not strictly needed but should improve reliability. Signed-off-by: Mickaël Salaün <mic@digikod.net> Cc: Arnd Bergmann <arnd@arndb.de> Cc: Serge E. Hallyn <serge@hallyn.com> Cc: James Morris <redacted> Cc: Kees Cook <redacted> --- include/uapi/asm-generic/errno-base.h | 1 + security/landlock/lsm.c | 6 +++--- 2 files changed, 4 insertions(+), 3 deletions(-)
diff --git a/include/uapi/asm-generic/errno-base.h b/include/uapi/asm-generic/errno-base.h
index 65115978510f..43407a403e72 100644
--- a/include/uapi/asm-generic/errno-base.h
+++ b/include/uapi/asm-generic/errno-base.h@@ -35,5 +35,6 @@ #define EPIPE 32 /* Broken pipe */ #define EDOM 33 /* Math argument out of domain of func */ #define ERANGE 34 /* Math result not representable */ +#define _ERRNO_LAST ERANGE #endif
diff --git a/security/landlock/lsm.c b/security/landlock/lsm.c
index aa9d4a64826e..322309068066 100644
--- a/security/landlock/lsm.c
+++ b/security/landlock/lsm.c@@ -11,7 +11,6 @@ #include <asm/current.h> #include <linux/bpf.h> /* enum bpf_reg_type, struct landlock_data */ #include <linux/cred.h> -#include <linux/err.h> /* MAX_ERRNO */ #include <linux/filter.h> /* struct bpf_prog, BPF_PROG_RUN() */ #include <linux/kernel.h> /* FIELD_SIZEOF() */ #include <linux/lsm_hooks.h>
@@ -104,8 +103,9 @@ static int landlock_run_prog(__u64 args[6]) } } if (!ret) { - if (cur_ret > MAX_ERRNO) - ret = MAX_ERRNO; + /* check errno to not mess with kernel code */ + if (cur_ret > _ERRNO_LAST) + ret = EPERM; else ret = cur_ret; }
--
2.8.1