From: Jann Horn <jann@thejh.net>
To: Andrew Morton <akpm@linux-foundation.org>,
Kees Cook <keescook@google.com>,
Casey Schaufler <casey@schaufler-ca.com>
Cc: Oleg Nesterov <oleg@redhat.com>, Ingo Molnar <mingo@redhat.com>,
James Morris <james.l.morris@oracle.com>,
"Serge E. Hallyn" <serge.hallyn@ubuntu.com>,
Andy Shevchenko <andriy.shevchenko@linux.intel.com>,
Andy Lutomirski <luto@kernel.org>,
Al Viro <viro@zeniv.linux.org.uk>,
"Eric W. Biederman" <ebiederm@xmission.com>,
Joe Perches <joe@perches.com>,
Thomas Gleixner <tglx@linutronix.de>,
Michael Kerrisk <mtk.manpages@gmail.com>,
linux-kernel@vger.kernel.org, linux-mm@kvack.org,
linux-security-module@vger.kernel.org, linux-api@vger.kernel.org,
security@kernel.org, Willy Tarreau <w@1wt.eu>
Subject: Re: [PATCH] ptrace: use fsuid, fsgid, effective creds for fs access checks
Date: Mon, 7 Dec 2015 22:25:10 +0100 [thread overview]
Message-ID: <1449523512-29200-1-git-send-email-jann@thejh.net> (raw)
In-Reply-To: <20151207203824.GA27364@pc.thejh.net>
Whoops. After Kees pointed out my last mistake, I decided to grep around a bit to make sure
I didn't miss anything else and noticed that apparently, Yama and Smack aren't completely
aware that the ptrace access mode can have flags ORed in? Until now, it was just the
NOAUDIT flag for /proc/$pid/stat, but with my patch, that would have been broken completely
as far as I can tell. I don't use either of those LSMs and didn't test with them.
Can the LSM maintainers have a look at this and say whether this looks okay now?
--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org. For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>
next prev parent reply other threads:[~2015-12-07 21:25 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-11-08 12:08 [PATCH] ptrace: use fsuid, fsgid, effective creds for fs access checks Jann Horn
2015-11-09 20:55 ` Andrew Morton
2015-11-09 21:06 ` Willy Tarreau
[not found] ` <20151109125554.43e6a711e59d1b8bf99cdeb1-de/tnXTf+JLsfHDXvbKv3WD2FQJk+8+b@public.gmane.org>
2015-11-09 21:12 ` Jann Horn
2015-11-09 21:19 ` Andrew Morton
[not found] ` <20151109131902.db961a5fe7b7fcbeb14f72fc-de/tnXTf+JLsfHDXvbKv3WD2FQJk+8+b@public.gmane.org>
2015-12-06 2:04 ` Jann Horn
2015-12-07 20:32 ` Kees Cook
[not found] ` <CAGXu5jJKOnWWSuLO5zWZ9=7Nhv0hWvJ0wEVJ3n+URY7-q_BCJw-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org>
2015-12-07 20:38 ` Jann Horn
2015-12-07 21:25 ` Jann Horn [this message]
2015-12-07 21:25 ` [PATCH 1/2] security: let security modules use PTRACE_MODE_* with bitmasks Jann Horn
2015-12-07 21:30 ` Kees Cook
2015-12-07 21:51 ` Casey Schaufler
2015-12-07 21:25 ` [PATCH 2/2] ptrace: use fsuid, fsgid, effective creds for fs access checks Jann Horn
2015-12-07 21:27 ` Kees Cook
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1449523512-29200-1-git-send-email-jann@thejh.net \
--to=jann@thejh.net \
--cc=akpm@linux-foundation.org \
--cc=andriy.shevchenko@linux.intel.com \
--cc=casey@schaufler-ca.com \
--cc=ebiederm@xmission.com \
--cc=james.l.morris@oracle.com \
--cc=joe@perches.com \
--cc=keescook@google.com \
--cc=linux-api@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=linux-security-module@vger.kernel.org \
--cc=luto@kernel.org \
--cc=mingo@redhat.com \
--cc=mtk.manpages@gmail.com \
--cc=oleg@redhat.com \
--cc=security@kernel.org \
--cc=serge.hallyn@ubuntu.com \
--cc=tglx@linutronix.de \
--cc=viro@zeniv.linux.org.uk \
--cc=w@1wt.eu \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).