Subject: [PATCH v2] sanitize task->comm to avoid leaking escape codes
From: Kees Cook <[email protected]>

Through get_task_comm() and many direct uses of task->comm in the kernel,
it is possible for escape codes and other non-printables to leak into
dmesg, syslog, etc.  In the worst case, these strings could be used to
attack administrators using vulnerable terminal emulators, and at least
cause confusion through the injection of \r characters.

This patch sanitizes task->comm to only contain printable characters
when it is set.  Additionally, it redefines get_task_comm so that it is
more obvious when misused by callers (presently nothing was incorrectly
calling get_task_comm's unsafe use of strncpy).

Signed-off-by: Kees Cook 
---
v2:
 - don't use a helper #define, just fix the arguments and callers
 - add missing ctype.h include that got lost during testing.
---
 drivers/char/tty_audit.c |    2 +-
 fs/exec.c                |   18 ++++++++++++++----
 fs/proc/array.c          |    4 ++--
 include/linux/sched.h    |    2 +-
 kernel/auditsc.c         |    2 +-
 kernel/capability.c      |    4 ++--
 kernel/fork.c            |    2 +-
 kernel/sys.c             |    2 +-
 8 files changed, 23 insertions(+), 13 deletions(-)

（省略）

 void set_task_comm(struct task_struct *tsk, char *buf)
 {
+	size_t i;
+
 	task_lock(tsk);
 
 	/*
@@ -955,7 +957,15 @@ void set_task_comm(struct task_struct *tsk, char *buf)
 	 */
 	memset(tsk->comm, 0, TASK_COMM_LEN);
 	wmb();
-	strlcpy(tsk->comm, buf, sizeof(tsk->comm));
+
+	/* sanitize non-printable characters */
+	for (i = 0; buf[i] && i < (sizeof(tsk->comm) - 1); i++) {
+		if (!isprint(buf[i]))
+			tsk->comm[i] = '?';
+		else
+			tsk->comm[i] = buf[i];
+	}
+
 	task_unlock(tsk);
 	perf_event_comm(tsk);
 }

関連記事

• topコマンドのSWAPフィールドの表示を直してみた (2010/07/04)
• Alanは相変わらず漢らしいなー (2010/06/30)
• MM Summit に inviteされた (2010/06/30)

On behalf of the 2010 Programme Committee, I'd like to invite you to
participate in the Linux Memory Management summit (jointly co-located
with the Storage and Filesystem summit) in Boston, MA, USA, on 8-9
August. You can find full details (including hotel) here:

http://events.linuxfoundation.org/events/lsf-summit

Please also register for the summit here:

http://events.linuxfoundation.org/events/lsf-summit/register
（以下略）

関連記事

• Alanは相変わらず漢らしいなー (2010/06/30)
• MM Summit に inviteされた (2010/06/30)
• さよなら CONFIG_4KSTACKS (2010/06/29)

関連記事

• MM Summit に inviteされた (2010/06/30)
• さよなら CONFIG_4KSTACKS (2010/06/29)
• [LKML名言集] BIOS書きってのは (2010/05/22)

関連記事

• rubyのtimerスレッドが邪悪すぎて生きるのがつらい (2010/07/12)
• 64bit linux上で32bit rubyをビルドする方法 (2010/06/26)
• Rubyの1.9への移行プラン (2010/04/01)

> @@ -221,8 +266,10 @@ for file access.
> .BR MADV_REMOVE ,
> .BR MADV_DONTFORK ,
> .BR MADV_DOFORK ,
> +.BR MAD_HWPOISON ,

Oh, I absolutely agree with you, MAD_HWPOISON indeed;
but Andi might prefer MADV_HWPOISON.

関連記事

• 今日覚えた英語 (2011/06/10)
• MAD_HWPOISON (2010/06/22)
• [英語] Your proposal looks very promissing to me. (2009/12/01)