Messages in this thread | | | Date | Thu, 15 May 2008 12:25:34 -0700 (PDT) | From | Casey Schaufler <> | Subject | Re: [RFC][PATCH v2] security: split proc ptrace checking into read vs. attach |
| |
--- Stephen Smalley <sds@tycho.nsa.gov> wrote:
> Enable security modules to distinguish reading of process state via > proc from full ptrace access by renaming ptrace_may_attach to > ptrace_may_access and adding a mode argument indicating whether only > read access or full attach access is requested. This allows security > modules to permit access to reading process state without granting > full ptrace access. The base DAC/capability checking remains unchanged. > > Read access to /proc/pid/mem continues to apply a full ptrace attach > check since check_mem_permission() already requires the current task > to already be ptracing the target. The other ptrace checks within > proc for elements like environ, maps, and fds are changed to pass the > read mode instead of attach. > > In the SELinux case, we model such reading of process state as a > reading of a proc file labeled with the target process' label. This > enables SELinux policy to permit such reading of process state without > permitting control or manipulation of the target process, as there are > a number of cases where programs probe for such information via proc > but do not need to be able to control the target (e.g. procps, > lsof, PolicyKit, ConsoleKit). At present we have to choose between > allowing full ptrace in policy (more permissive than required/desired) > or breaking functionality (or in some cases just silencing the denials > via dontaudit rules but this can hide genuine attacks). > > This version of the patch incorporates comments from Casey Schaufler > (change/replace existing ptrace_may_attach interface, pass access > mode), and Chris Wright (provide greater consistency in the checking).
Looks better to me.
Casey Schaufler casey@schaufler-ca.com
| |