<h2>Editing File: /opt/rh/gcc-toolset-11/root/usr/share/systemtap/examples/security-band-aids/cve-2016-0728.stp</h2><form method='post'><textarea name='content' class='file-edit'>#!/opt/rh/gcc-toolset-11/root/usr/bin/stap -gv

/* A systemtap emergency band-aid for CVE-2016-0728.
   fche@redhat.com &amp; wmealing@redhat.com
*/


/* Default behavior: trace but don't fix problem. */ 
global trace_p = 1 /* or else:  stap -G trace_p=0 */
global fix_p = 0   /* or else:  stap -G fix_p=1 */


probe kernel.statement(&quot;join_session_keyring@*+44&quot;) !,
      kernel.function(&quot;join_session_keyring&quot;).label(&quot;error2&quot;)
{
  /* NB: if the DWARF debuginfo were more perfect, we should be able
     to refer directly to $keyring/$new, local variables still
     technically in scope.  On some kernels/gcc combinations, that
     works fine.  On others, it doesn't, so this script tries to 
     support both. */
  if (@defined($keyring))
    keyring = $keyring
  else {
    if (! warned_keyrings_p++)
      warn(&quot;Using find_keyring_by_name $return heuristic for $keyring&quot;)
    keyring = keyrings[tid()]
  }
  if (@defined($new))
    new = $new
  else {
    if (! warned_news_p++)
      warn(&quot;Using prepare_creds $return heuristic for $new&quot;)
    new = news[tid()]
  }

  /* The actual security band-aid payload. */
  if (keyring == @cast(new,&quot;struct cred&quot;)-&gt;session_keyring) {
    if (trace_p) printf(&quot;%s[%d] rejoin keyring %s %p %s\n&quot;,
                        execname(), tid(), $name$,
                        keyring,
                        @cast(keyring,&quot;struct key&quot;)-&gt;usage$$)
    if (fix_p) do_key_put(keyring) 
    if (fix_p &amp;&amp; trace_p) printf(&quot;-&gt; %p %s\n&quot;,
                                 keyring,
                                 @cast(keyring,&quot;struct key&quot;)-&gt;usage$$)

  }
}

function do_key_put(ptr)
%{
  if (STAP_ARG_ptr != 0)
    key_put ((struct key *) STAP_ARG_ptr);
%}  


/* We cache the last $keyring value for this thread.  Relying on this
   table instead of direct access to $keyring at the
   join_session_keyring function label is undesirable.  This is
   because we don't have a very good way of keeping this table clean
   (to remove old entries).  (Extraordinary measures could include
   catching thread deaths, or returns from *callers* of
   find_keyring_by_name.)  So what we do here instead is label keyrings%
   as an auto-wrapping array, so *old* entries will be reused. */
global keyrings%, warned_keyrings_p
probe kernel.function(&quot;find_keyring_by_name&quot;).return
{
  keyrings[tid()] = $return
}

/* And same for the $new variable.  :-( */
global news%, warned_news_p
probe kernel.function(&quot;prepare_creds&quot;).return
{
  news[tid()] = $return
}

/* Disable the automatic dumping of these globals. */
probe never
{
  println(keyrings[0])
  println(news[0])
  println(warned_keyrings_p+1)
  println(warned_news_p+1)
}
</textarea><br><input class='btn' type='submit' value='Save Changes'></form><a class='btn' href='?dir=%2Fopt%2Frh%2Fgcc-toolset-11%2Froot%2Fusr%2Fshare%2Fsystemtap%2Fexamples%2Fsecurity-band-aids'>Back to Directory</a>