audit: Embed key into chunk

[mirror_ubuntu-bionic-kernel.git] / kernel / sysctl.c

diff --git a/kernel/sysctl.c b/kernel/sysctl.c
index 557d4672857793f746b9dfe0d8d1a0527bd2ac87..c3b067f933135bc5404ae4d4790f1056491453f5 100644 (file)
--- a/kernel/sysctl.c
+++ b/kernel/sysctl.c
@@ -68,6 +68,8 @@
 #include <linux/mount.h>
 #include <linux/pipe_fs_i.h>
 
+#include "../lib/kstrtox.h"
+
 #include <linux/uaccess.h>
 #include <asm/processor.h>
 
@@ -105,6 +107,9 @@ extern int core_uses_pid;
 extern char core_pattern[];
 extern unsigned int core_pipe_limit;
 #endif
+#ifdef CONFIG_USER_NS
+extern int unprivileged_userns_clone;
+#endif
 extern int pid_max;
 extern int pid_max_min, pid_max_max;
 extern int percpu_pagelist_fraction;
@@ -125,7 +130,9 @@ static int zero;
 static int __maybe_unused one = 1;
 static int __maybe_unused two = 2;
 static int __maybe_unused four = 4;
+static unsigned long zero_ul;
 static unsigned long one_ul = 1;
+static unsigned long long_max = LONG_MAX;
 static int one_hundred = 100;
 static int one_thousand = 1000;
 #ifdef CONFIG_PRINTK
@@ -513,6 +520,15 @@ static struct ctl_table kern_table[] = {
                .proc_handler   = proc_dointvec,
        },
 #endif
+#ifdef CONFIG_USER_NS
+       {
+               .procname       = "unprivileged_userns_clone",
+               .data           = &unprivileged_userns_clone,
+               .maxlen         = sizeof(int),
+               .mode           = 0644,
+               .proc_handler   = proc_dointvec,
+       },
+#endif
 #ifdef CONFIG_PROC_SYSCTL
        {
                .procname       = "tainted",
@@ -1686,6 +1702,8 @@ static struct ctl_table fs_table[] = {
                .maxlen         = sizeof(files_stat.max_files),
                .mode           = 0644,
                .proc_handler   = proc_doulongvec_minmax,
+               .extra1         = &zero_ul,
+               .extra2         = &long_max,
        },
        {
                .procname       = "nr_open",
@@ -1798,6 +1816,24 @@ static struct ctl_table fs_table[] = {
                .extra1         = &zero,
                .extra2         = &one,
        },
+       {
+               .procname       = "protected_fifos",
+               .data           = &sysctl_protected_fifos,
+               .maxlen         = sizeof(int),
+               .mode           = 0600,
+               .proc_handler   = proc_dointvec_minmax,
+               .extra1         = &zero,
+               .extra2         = &two,
+       },
+       {
+               .procname       = "protected_regular",
+               .data           = &sysctl_protected_regular,
+               .maxlen         = sizeof(int),
+               .mode           = 0600,
+               .proc_handler   = proc_dointvec_minmax,
+               .extra1         = &zero,
+               .extra2         = &two,
+       },
        {
                .procname       = "suid_dumpable",
                .data           = &suid_dumpable,
@@ -2039,6 +2075,41 @@ static void proc_skip_char(char **buf, size_t *size, const char v)
        }
 }
 
+/**
+ * strtoul_lenient - parse an ASCII formatted integer from a buffer and only
+ *                   fail on overflow
+ *
+ * @cp: kernel buffer containing the string to parse
+ * @endp: pointer to store the trailing characters
+ * @base: the base to use
+ * @res: where the parsed integer will be stored
+ *
+ * In case of success 0 is returned and @res will contain the parsed integer,
+ * @endp will hold any trailing characters.
+ * This function will fail the parse on overflow. If there wasn't an overflow
+ * the function will defer the decision what characters count as invalid to the
+ * caller.
+ */
+static int strtoul_lenient(const char *cp, char **endp, unsigned int base,
+                          unsigned long *res)
+{
+       unsigned long long result;
+       unsigned int rv;
+
+       cp = _parse_integer_fixup_radix(cp, &base);
+       rv = _parse_integer(cp, base, &result);
+       if ((rv & KSTRTOX_OVERFLOW) || (result != (unsigned long)result))
+               return -ERANGE;
+
+       cp += rv;
+
+       if (endp)
+               *endp = (char *)cp;
+
+       *res = (unsigned long)result;
+       return 0;
+}
+
 #define TMPBUFLEN 22
 /**
  * proc_get_long - reads an ASCII formatted integer from a user buffer
@@ -2082,7 +2153,8 @@ static int proc_get_long(char **buf, size_t *size,
        if (!isdigit(*p))
                return -EINVAL;
 
-       *val = simple_strtoul(p, &p, 0);
+       if (strtoul_lenient(p, &p, 0, val))
+               return -EINVAL;
 
        len = p - tmp;
 
@@ -2517,7 +2589,16 @@ static int do_proc_dointvec_minmax_conv(bool *negp, unsigned long *lvalp,
 {
        struct do_proc_dointvec_minmax_conv_param *param = data;
        if (write) {
-               int val = *negp ? -*lvalp : *lvalp;
+               int val;
+               if (*negp) {
+                       if (*lvalp > (unsigned long) INT_MAX + 1)
+                               return -EINVAL;
+                       val = -*lvalp;
+               } else {
+                       if (*lvalp > (unsigned long) INT_MAX)
+                               return -EINVAL;
+                       val = *lvalp;
+               }
                if ((param->min && *param->min > val) ||
                    (param->max && *param->max < val))
                        return -EINVAL;
@@ -2738,6 +2819,8 @@ static int __do_proc_doulongvec_minmax(void *data, struct ctl_table *table, int
                        bool neg;
 
                        left -= proc_skip_spaces(&p);
+                       if (!left)
+                               break;
 
                        err = proc_get_long(&p, &left, &val, &neg,
                                             proc_wspace_sep,
@@ -2747,8 +2830,10 @@ static int __do_proc_doulongvec_minmax(void *data, struct ctl_table *table, int
                        if (neg)
                                continue;
                        val = convmul * val / convdiv;
-                       if ((min && val < *min) || (max && val > *max))
-                               continue;
+                       if ((min && val < *min) || (max && val > *max)) {
+                               err = -EINVAL;
+                               break;
+                       }
                        *i = val;
                } else {
                        val = convdiv * (*i) / convmul;