Re: [PATCH 1/2] exec: load_script: don't blindly truncate shebang string

2018-11-13 Thread Kees Cook
On Mon, Nov 12, 2018 at 10:09 AM, Oleg Nesterov wrote: > load_script() simply truncates bprm->buf and this is very wrong if the > length of shebang string exceeds BINPRM_BUF_SIZE-2. This can silently > truncate i_arg or (worse) we can execute the wrong binary if buf[2:126] > happens to be the vali

Re: [PATCH 1/2] exec: load_script: don't blindly truncate shebang string

2018-11-13 Thread Oleg Nesterov
On 11/13, Michal Hocko wrote: > > A bit cryptic to my taste Ys, because I didn't want to touch the code below. We need to cleanup the whole "parse bprm->buf" code, not only this part. > but it looks correct. I have tried to come up > with something more tasty but I am afraid it would be just

Re: [PATCH 1/2] exec: load_script: don't blindly truncate shebang string

2018-11-13 Thread Michal Hocko
On Mon 12-11-18 17:09:31, Oleg Nesterov wrote: > load_script() simply truncates bprm->buf and this is very wrong if the > length of shebang string exceeds BINPRM_BUF_SIZE-2. This can silently > truncate i_arg or (worse) we can execute the wrong binary if buf[2:126] > happens to be the valid executa

[PATCH 1/2] exec: load_script: don't blindly truncate shebang string

2018-11-12 Thread Oleg Nesterov
load_script() simply truncates bprm->buf and this is very wrong if the length of shebang string exceeds BINPRM_BUF_SIZE-2. This can silently truncate i_arg or (worse) we can execute the wrong binary if buf[2:126] happens to be the valid executable path. Change load_script() to return ENOEXEC if it