nptl: Properly inline setgroups syscall [BZ #26248]
Commit Message
nptl has
/* Opcodes and data types for communication with the signal handler to
change user/group IDs. */
struct xid_command
{
int syscall_no;
long int id[3];
volatile int cntr;
volatile int error;
};
/* This must be last, otherwise the current thread might not have
permissions to send SIGSETXID syscall to the other threads. */
result = INTERNAL_SYSCALL_NCS (cmdp->syscall_no, 3,
cmdp->id[0], cmdp->id[1], cmdp->id[2]);
But the second argument of setgroups syscal is a pointer:
int setgroups(size_t size, const gid_t *list);
But on x32, pointers passed to syscall must have pointer type so that they
will be zero-extended.
Add <setxid-internal.h> to define INTERNAL_SETXID_SYSCALL_NCS and use it,
instead of INTERNAL_SYSCALL_NCS, for SETXID syscalls. X32 override it
with pointer type for setgroups. A testcase is added and setgroups
returned with EFAULT when running as root without the fix.
---
nptl/allocatestack.c | 4 +-
nptl/nptl-init.c | 4 +-
sysdeps/nptl/setxid-internal.h | 21 +++++++
sysdeps/unix/sysv/linux/x86_64/x32/Makefile | 4 ++
.../sysv/linux/x86_64/x32/setxid-internal.h | 36 +++++++++++
.../sysv/linux/x86_64/x32/tst-setgroups.c | 62 +++++++++++++++++++
6 files changed, 127 insertions(+), 4 deletions(-)
create mode 100644 sysdeps/nptl/setxid-internal.h
create mode 100644 sysdeps/unix/sysv/linux/x86_64/x32/setxid-internal.h
create mode 100644 sysdeps/unix/sysv/linux/x86_64/x32/tst-setgroups.c
Comments
* H. J. Lu via Libc-alpha:
> nptl has
>
> /* Opcodes and data types for communication with the signal handler to
> change user/group IDs. */
> struct xid_command
> {
> int syscall_no;
> long int id[3];
> volatile int cntr;
> volatile int error;
> };
>
> /* This must be last, otherwise the current thread might not have
> permissions to send SIGSETXID syscall to the other threads. */
> result = INTERNAL_SYSCALL_NCS (cmdp->syscall_no, 3,
> cmdp->id[0], cmdp->id[1], cmdp->id[2]);
>
> But the second argument of setgroups syscal is a pointer:
>
> int setgroups(size_t size, const gid_t *list);
>
> But on x32, pointers passed to syscall must have pointer type so that they
> will be zero-extended.
>
> Add <setxid-internal.h> to define INTERNAL_SETXID_SYSCALL_NCS and use it,
> instead of INTERNAL_SYSCALL_NCS, for SETXID syscalls. X32 override it
> with pointer type for setgroups. A testcase is added and setgroups
> returned with EFAULT when running as root without the fix.
Isn't it sufficient to change the type of id to unsigned long int[3]?
The UID arguments are unsigned on the kernel side, so no sign extension
is required.
Thanks,
Florian
@@ -32,6 +32,7 @@
#include <futex-internal.h>
#include <kernel-features.h>
#include <stack-aliasing.h>
+#include <setxid-internal.h>
#ifndef NEED_SEPARATE_REGISTER_STACK
@@ -1159,8 +1160,7 @@ __nptl_setxid (struct xid_command *cmdp)
/* This must be last, otherwise the current thread might not have
permissions to send SIGSETXID syscall to the other threads. */
- result = INTERNAL_SYSCALL_NCS (cmdp->syscall_no, 3,
- cmdp->id[0], cmdp->id[1], cmdp->id[2]);
+ result = INTERNAL_SETXID_SYSCALL_NCS (cmdp);
int error = 0;
if (__glibc_unlikely (INTERNAL_SYSCALL_ERROR_P (result)))
{
@@ -39,6 +39,7 @@
#include <libc-pointer-arith.h>
#include <pthread-pids.h>
#include <pthread_mutex_conf.h>
+#include <setxid-internal.h>
#ifndef TLS_MULTIPLE_THREADS_IN_TCB
/* Pointer to the corresponding variable in libc. */
@@ -188,8 +189,7 @@ sighandler_setxid (int sig, siginfo_t *si, void *ctx)
|| si->si_code != SI_TKILL)
return;
- result = INTERNAL_SYSCALL_NCS (__xidcmd->syscall_no, 3, __xidcmd->id[0],
- __xidcmd->id[1], __xidcmd->id[2]);
+ result = INTERNAL_SETXID_SYSCALL_NCS (__xidcmd);
int error = 0;
if (__glibc_unlikely (INTERNAL_SYSCALL_ERROR_P (result)))
error = INTERNAL_SYSCALL_ERRNO (result);
new file mode 100644
@@ -0,0 +1,21 @@
+/* INTERNAL_SETXID_SYSCALL_NCS. Generic version.
+ Copyright (C) 2020 Free Software Foundation, Inc.
+ This file is part of the GNU C Library.
+
+ The GNU C Library is free software; you can redistribute it and/or
+ modify it under the terms of the GNU Lesser General Public
+ License as published by the Free Software Foundation; either
+ version 2.1 of the License, or (at your option) any later version.
+
+ The GNU C Library is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ Lesser General Public License for more details.
+
+ You should have received a copy of the GNU Lesser General Public
+ License along with the GNU C Library; if not, see
+ <https://www.gnu.org/licenses/>. */
+
+#define INTERNAL_SETXID_SYSCALL_NCS(cmd) \
+ INTERNAL_SYSCALL_NCS (cmd->syscall_no, 3, cmd->id[0], cmd->id[1], \
+ cmd->id[2])
@@ -5,6 +5,10 @@ ifeq ($(subdir),misc)
sysdep_routines += arch_prctl
endif
+ifeq ($(subdir),nptl)
+xtests += tst-setgroups
+endif
+
ifeq ($(subdir),conform)
# For bugs 16437 and 21279.
conformtest-xfail-conds += x86_64-x32-linux
new file mode 100644
@@ -0,0 +1,36 @@
+/* INTERNAL_SETXID_SYSCALL_NCS. X32 version.
+ Copyright (C) 2020 Free Software Foundation, Inc.
+ This file is part of the GNU C Library.
+
+ The GNU C Library is free software; you can redistribute it and/or
+ modify it under the terms of the GNU Lesser General Public
+ License as published by the Free Software Foundation; either
+ version 2.1 of the License, or (at your option) any later version.
+
+ The GNU C Library is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ Lesser General Public License for more details.
+
+ You should have received a copy of the GNU Lesser General Public
+ License along with the GNU C Library; if not, see
+ <https://www.gnu.org/licenses/>. */
+
+/* Enforce zero-extension for the pointer argument in
+
+ int setgroups(size_t size, const gid_t *list);
+
+ */
+#define INTERNAL_SETXID_SYSCALL_NCS(cmd) \
+ ({ \
+ int __result; \
+ if (__glibc_unlikely (cmd->syscall_no == __NR_setgroups)) \
+ __result = INTERNAL_SYSCALL_NCS (__NR_setgroups, 2, \
+ cmd->id[0], \
+ (void *) cmd->id[1]); \
+ else \
+ __result = INTERNAL_SYSCALL_NCS (cmd->syscall_no, 3, \
+ cmd->id[0], cmd->id[1], \
+ cmd->id[2]); \
+ __result; \
+ })
new file mode 100644
@@ -0,0 +1,62 @@
+/* Basic test for setgroups
+ Copyright (C) 2020 Free Software Foundation, Inc.
+ This file is part of the GNU C Library.
+
+ The GNU C Library is free software; you can redistribute it and/or
+ modify it under the terms of the GNU Lesser General Public
+ License as published by the Free Software Foundation; either
+ version 2.1 of the License, or (at your option) any later version.
+
+ The GNU C Library is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ Lesser General Public License for more details.
+
+ You should have received a copy of the GNU Lesser General Public
+ License along with the GNU C Library; if not, see
+ <https://www.gnu.org/licenses/>. */
+
+#include <stdlib.h>
+#include <limits.h>
+#include <grp.h>
+#include <errno.h>
+#include <error.h>
+#include <support/xthread.h>
+#include <support/support.h>
+#include <support/test-driver.h>
+#include <support/xunistd.h>
+
+static void *
+start_routine (void *args)
+{
+ return NULL;
+}
+
+static int
+do_test (void)
+{
+ int size;
+ /* NB: Stack address is at 0xfffXXXXX. */
+ gid_t list[NGROUPS_MAX];
+ int status = EXIT_SUCCESS;
+
+ pthread_t thread = xpthread_create (NULL, start_routine, NULL);
+
+ size = getgroups (sizeof (list) / sizeof (list[0]), list);
+ if (size < 0)
+ {
+ status = EXIT_FAILURE;
+ error (0, errno, "getgroups failed");
+ }
+ if (setgroups (size, list) < 0 && errno != EPERM)
+ {
+ status = EXIT_FAILURE;
+ error (0, errno, "setgroups failed");
+ }
+
+ xpthread_join (thread);
+
+ return status;
+}
+
+#include <support/test-driver.c>