lkml.org 
[lkml]   [2018]   [Oct]   [16]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [PATCH] kernel/signal: Signal-based pre-coredump notification
    > +/*
    > + * Returns true if current's euid is same as p's uid or euid,
    > + * or has CAP_SYS_ADMIN.
    > + *
    > + * Called with rcu_read_lock, creds are safe.
    > + *
    > + * Adapted from set_one_prio_perm().
    > + */
    > +static bool set_predump_signal_perm(struct task_struct *p)
    > +{
    > + const struct cred *cred = current_cred(), *pcred = __task_cred(p);
    > +
    > + return uid_eq(pcred->uid, cred->euid) ||
    > + uid_eq(pcred->euid, cred->euid) ||
    > + capable(CAP_SYS_ADMIN);
    > +}

    This makes absolutely no security sense whatsoever. The uid and euid of
    the parent and child can both change between the test and the signal
    delivery.

    There are reasons that the child signal control code is incredibly
    careful about either the parent or child using execve or doing a
    privilege change that might pose a risk.

    Until this code gets the same protections I don't believe it's safe.

    Alan

    \
     
     \ /
      Last update: 2018-10-15 23:24    [W:4.140 / U:0.076 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site