From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from shadbolt.e.decadent.org.uk ([88.96.1.126]:35324 "EHLO shadbolt.e.decadent.org.uk" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751426AbbHAUoS (ORCPT ); Sat, 1 Aug 2015 16:44:18 -0400 Message-ID: <1438461851.3225.41.camel@decadent.org.uk> Subject: Re: [PATCH 2/2] __ptrace_may_access() should not deny sub-threads From: Ben Hutchings To: Sheng Yong , gregkh@linuxfoundation.org Cc: stable@vger.kernel.org, oleg@redhat.com, mgrondona@llnl.gov Date: Sat, 01 Aug 2015 21:44:11 +0100 In-Reply-To: <1431914844-66627-3-git-send-email-shengyong1@huawei.com> References: <1431914844-66627-1-git-send-email-shengyong1@huawei.com> <1431914844-66627-3-git-send-email-shengyong1@huawei.com> Content-Type: multipart/signed; micalg="pgp-sha512"; protocol="application/pgp-signature"; boundary="=-U9/vl+3ugT1K52ZMGxut" Mime-Version: 1.0 Sender: stable-owner@vger.kernel.org List-ID: --=-U9/vl+3ugT1K52ZMGxut Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Mon, 2015-05-18 at 02:07 +0000, Sheng Yong wrote: > From: Mark Grondona >=20 > commit 73af963f9f3036dffed55c3a2898598186db1045 upstream. >=20 > __ptrace_may_access() checks get_dumpable/ptrace_has_cap/etc if task !=3D > current, this can can lead to surprising results. >=20 > For example, a sub-thread can't readlink("/proc/self/exe") if the > executable is not readable. setup_new_exec()->would_dump() notices that > inode_permission(MAY_READ) fails and then it does > set_dumpable(suid_dumpable). After that get_dumpable() fails. >=20 > (It is not clear why proc_pid_readlink() checks get_dumpable(), perhaps w= e > could add PTRACE_MODE_NODUMPABLE) >=20 > Change __ptrace_may_access() to use same_thread_group() instead of "task > =3D=3D current". Any security check is pointless when the tasks share th= e > same ->mm. [...] Queued up for 3.2, thanks. Ben. --=20 Ben Hutchings One of the nice things about standards is that there are so many of them. --=-U9/vl+3ugT1K52ZMGxut Content-Type: application/pgp-signature; name="signature.asc" Content-Description: This is a digitally signed message part -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUAVb0vm+e/yOyVhhEJAQqrSw/+ME2IjwhiFPO/MEs6NAuciSkzCOhXcSul rA2zzVhcixqTswmoE12ZnAadvnRWPwngGQFPbQAbh9mrTbPCmTSIAL9V6QLxSAz2 ZHcWrzJV4lIxR/gcm/RopCN39caGY+JnIy5AD4atpVDTRFxH65BWMA94+59fFK9q yyeBtKtpxzkumsC7ubT3QhYL+/YdLQVRucEf0TTy11BSXrs6PJRDymVm8FrSCfm2 dMGTqFgH3sWo5/piq+tut6oyDHgzmvv1B1XbutfRZhug2uYZX8D3WSfgSLSFOQFF eIcKbhQBTcs2C4ab2CtMJSC4CwsQDov5Z95foigbcg6t3w3fl8AYBj1Bn1nWLKBw lI7oJiEmKUwptxMAHoEf/91ji03w5FrHDpbPVRgiIv+ZVFuLuwFdjTiFQVCYSFJX rq7wFlD1YeiblBvN6WDL+ny2D9t9AYwRzt/NBv70PvsYMZUR/lY8cxlkzXy7f9yi 4uCqCbs5yC6lCVXiN5fpQuw+oNH/R8CeU4s0ZSbuyWOSUpOrnPcEAKtpB/p/kOSp 0+L533sF/bCiOTd4KIBIrxLnMAaJrmCV0fnQwhfHhUqbS6fpjPixjT8lE1qsY4qu elCxtzNh3UKwWlwWuv2fkmLGTbtKqp9QdbDtfhYi+j5C6i2jA7swLhJAhYHVFj1a tU6017DgIug= =A96+ -----END PGP SIGNATURE----- --=-U9/vl+3ugT1K52ZMGxut--