From: Paolo 'Blaisorblade' Giarrusso , Henrik Nordstrom , Michael Richardson When a child mm is created by opening /proc/mm, without this patch its mm->dumpable flag is left set to 0, even when there is no reason to do so. This way, for instance, if is the pid of a userspace thread, /proc/ is only readable by root (which was the original reason letting this be diagnosed by Michael Richardson). Paolo and Henrik discussed about this in detail, finally Paolo wrote the patch and sent it for comment. Signed-off-by: Paolo 'Blaisorblade' Giarrusso --- vanilla-linux-2.6.9-paolo/arch/i386/kernel/ptrace.c | 8 ++++++++ vanilla-linux-2.6.9-paolo/mm/proc_mm.c | 2 ++ 2 files changed, 10 insertions(+) diff -puN mm/proc_mm.c~fix-dumpable-handling mm/proc_mm.c --- vanilla-linux-2.6.9/mm/proc_mm.c~fix-dumpable-handling 2004-10-26 00:54:35.478864480 +0200 +++ vanilla-linux-2.6.9-paolo/mm/proc_mm.c 2004-10-26 00:54:35.482863872 +0200 @@ -126,6 +126,8 @@ static int open_proc_mm(struct inode *in init_new_empty_context(mm); arch_pick_mmap_layout(mm); + mm->dumpable = current->mm->dumpable; + wmb(); spin_lock(&mmlist_lock); list_add(&mm->mmlist, ¤t->mm->mmlist); diff -puN arch/i386/kernel/ptrace.c~fix-dumpable-handling arch/i386/kernel/ptrace.c --- vanilla-linux-2.6.9/arch/i386/kernel/ptrace.c~fix-dumpable-handling 2004-10-26 00:54:35.480864176 +0200 +++ vanilla-linux-2.6.9-paolo/arch/i386/kernel/ptrace.c 2004-10-26 00:54:35.483863720 +0200 @@ -568,6 +568,14 @@ asmlinkage int sys_ptrace(long request, break; } + /* Let's be safe. If we are ptraced from a non-dumpable process, + * let's not be dumpable. Don't try to be smart and turn + * current->dumpable to 1: it may be unsafe.*/ + if (!current->dumpable) { + new->dumpable = 0; + wmb(); + } + atomic_inc(&new->mm_users); child->mm = new; child->active_mm = new; _