From: Ben Hutchings <ben@decadent.org.uk>
To: Sheng Yong <shengyong1@huawei.com>, gregkh@linuxfoundation.org
Cc: stable@vger.kernel.org, oleg@redhat.com, mgrondona@llnl.gov
Subject: Re: [PATCH 2/2] __ptrace_may_access() should not deny sub-threads
Date: Sat, 01 Aug 2015 21:44:11 +0100 [thread overview]
Message-ID: <1438461851.3225.41.camel@decadent.org.uk> (raw)
In-Reply-To: <1431914844-66627-3-git-send-email-shengyong1@huawei.com>
[-- Attachment #1: Type: text/plain, Size: 992 bytes --]
On Mon, 2015-05-18 at 02:07 +0000, Sheng Yong wrote:
> From: Mark Grondona <mgrondona@llnl.gov>
>
> commit 73af963f9f3036dffed55c3a2898598186db1045 upstream.
>
> __ptrace_may_access() checks get_dumpable/ptrace_has_cap/etc if task !=
> current, this can can lead to surprising results.
>
> For example, a sub-thread can't readlink("/proc/self/exe") if the
> executable is not readable. setup_new_exec()->would_dump() notices that
> inode_permission(MAY_READ) fails and then it does
> set_dumpable(suid_dumpable). After that get_dumpable() fails.
>
> (It is not clear why proc_pid_readlink() checks get_dumpable(), perhaps we
> could add PTRACE_MODE_NODUMPABLE)
>
> Change __ptrace_may_access() to use same_thread_group() instead of "task
> == current". Any security check is pointless when the tasks share the
> same ->mm.
[...]
Queued up for 3.2, thanks.
Ben.
--
Ben Hutchings
One of the nice things about standards is that there are so many of them.
[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 811 bytes --]
next prev parent reply other threads:[~2015-08-01 20:44 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-05-18 2:07 [request for inclusion 3.10][PATCH 0/2] fix thread cannot access stat in the same group Sheng Yong
2015-05-18 2:07 ` [PATCH 1/2] include/linux/sched.h: don't use task->pid/tgid in same_thread_group/has_group_leader_pid Sheng Yong
2015-08-01 20:43 ` Ben Hutchings
2015-05-18 2:07 ` [PATCH 2/2] __ptrace_may_access() should not deny sub-threads Sheng Yong
2015-08-01 20:44 ` Ben Hutchings [this message]
2015-06-29 23:13 ` [request for inclusion 3.10][PATCH 0/2] fix thread cannot access stat in the same group Greg KH
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1438461851.3225.41.camel@decadent.org.uk \
--to=ben@decadent.org.uk \
--cc=gregkh@linuxfoundation.org \
--cc=mgrondona@llnl.gov \
--cc=oleg@redhat.com \
--cc=shengyong1@huawei.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).