Re: procfs: boot- and runtime configurable access mode for /proc/<pid> dirs

[Al Viro <viro@ZenIV.linux.org.uk>]

On Fri, Mar 25, 2011 at 02:24:48PM -0700, Christian Kujau wrote:
> 
> Not sure If I understand correctly, but:
> 
> On Thu, 24 Mar 2011 at 20:37, Al Viro wrote:
> > Bull.  /proc/<pid>/foo contents is sensitive, your patch doesn't do
> > you any good.  fork(), open /proc/<child's PID>/foo in parent, then
> > exec suid-root binary in child.
> 
> ...you would have to roll your own suid-root binary to be able to look 
> into other /proc/PID directories, no? But making a binary suid-root 
> requires root to begin with.

No.  You could look into /proc/PID/foo of process running a suid-root binary
that you have execve()'ed.  A binary that had been there legitimately.  If
these files have sensitive contents, you have a bad problem on hands (and we
had quite a few of those); IOW, you need to do checks at read(2) time, since
the identity of owner can change between open() and read().  And if you do
those checks there, you don't need to care about open-time checks at all,
since any attempt to do IO will be rejected anyway.