* [PATCH] c/r: tighten ptrace checking for checkpoint to PTRACE_MODE_ATTACH
@ 2009-06-25 9:34 Oren Laadan
2009-06-25 12:48 ` Serge E. Hallyn
0 siblings, 1 reply; 2+ messages in thread
From: Oren Laadan @ 2009-06-25 9:34 UTC (permalink / raw)
To: Linux Containers
Cc: Oren Laadan, Serge E. Hallyn, Stephen Smalley, Casey Schaufler,
linux-security-module, SELinux, Alexey Dobriyan, Andrew Morgan
Security modules distinguish reading of process state (via proc) from
full ptrace access using the access mode: PTRACE_MODE_{READ,ATTACH}.
Read access to /proc/pid/mem requires a full ptrace attach (for more
details, see: http://lwn.net/Articles/282930/).
Checkpoint needs access to full process state, including memory, so
we require PTRACE_MODE_ATTACH.
Signed-off-by: Oren Laadan <orenl@cs.columbia.edu>
---
checkpoint/checkpoint.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/checkpoint/checkpoint.c b/checkpoint/checkpoint.c
index 325dfa3..7b141e3 100644
--- a/checkpoint/checkpoint.c
+++ b/checkpoint/checkpoint.c
@@ -296,7 +296,7 @@ static int may_checkpoint_task(struct ckpt_ctx *ctx, struct task_struct *t)
return -EAGAIN;
}
- if (!ptrace_may_access(t, PTRACE_MODE_READ)) {
+ if (!ptrace_may_access(t, PTRACE_MODE_ATTACH)) {
__ckpt_write_err(ctx, "access to task %d (%s) denied",
task_pid_vnr(t), t->comm);
return -EPERM;
--
1.6.0.4
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] c/r: tighten ptrace checking for checkpoint to PTRACE_MODE_ATTACH
2009-06-25 9:34 [PATCH] c/r: tighten ptrace checking for checkpoint to PTRACE_MODE_ATTACH Oren Laadan
@ 2009-06-25 12:48 ` Serge E. Hallyn
0 siblings, 0 replies; 2+ messages in thread
From: Serge E. Hallyn @ 2009-06-25 12:48 UTC (permalink / raw)
To: Oren Laadan
Cc: Linux Containers, Stephen Smalley, Casey Schaufler,
linux-security-module, SELinux, Alexey Dobriyan, Andrew Morgan
Quoting Oren Laadan (orenl@cs.columbia.edu):
> Security modules distinguish reading of process state (via proc) from
> full ptrace access using the access mode: PTRACE_MODE_{READ,ATTACH}.
>
> Read access to /proc/pid/mem requires a full ptrace attach (for more
> details, see: http://lwn.net/Articles/282930/).
>
> Checkpoint needs access to full process state, including memory, so
> we require PTRACE_MODE_ATTACH.
>
> Signed-off-by: Oren Laadan <orenl@cs.columbia.edu>
Acked-by: Serge Hallyn <serue@us.ibm.com>
thanks,
-serge
> ---
> checkpoint/checkpoint.c | 2 +-
> 1 files changed, 1 insertions(+), 1 deletions(-)
>
> diff --git a/checkpoint/checkpoint.c b/checkpoint/checkpoint.c
> index 325dfa3..7b141e3 100644
> --- a/checkpoint/checkpoint.c
> +++ b/checkpoint/checkpoint.c
> @@ -296,7 +296,7 @@ static int may_checkpoint_task(struct ckpt_ctx *ctx, struct task_struct *t)
> return -EAGAIN;
> }
>
> - if (!ptrace_may_access(t, PTRACE_MODE_READ)) {
> + if (!ptrace_may_access(t, PTRACE_MODE_ATTACH)) {
> __ckpt_write_err(ctx, "access to task %d (%s) denied",
> task_pid_vnr(t), t->comm);
> return -EPERM;
> --
> 1.6.0.4
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2009-06-25 12:48 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2009-06-25 9:34 [PATCH] c/r: tighten ptrace checking for checkpoint to PTRACE_MODE_ATTACH Oren Laadan
2009-06-25 12:48 ` Serge E. Hallyn
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox