lkml.org 
[lkml]   [2018]   [Oct]   [16]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    SubjectRe: [PATCH] kernel/signal: Signal-based pre-coredump notification
    From
    Date
    Hi, Alan:

    As I replied earlier, I will remove the logic that allows setting on others.
    This function "set_predump_signal_perm()" will be gone too.

    Thanks. -- Enke

    On 10/15/18 2:21 PM, Alan Cox wrote:
    >> +/*
    >> + * Returns true if current's euid is same as p's uid or euid,
    >> + * or has CAP_SYS_ADMIN.
    >> + *
    >> + * Called with rcu_read_lock, creds are safe.
    >> + *
    >> + * Adapted from set_one_prio_perm().
    >> + */
    >> +static bool set_predump_signal_perm(struct task_struct *p)
    >> +{
    >> + const struct cred *cred = current_cred(), *pcred = __task_cred(p);
    >> +
    >> + return uid_eq(pcred->uid, cred->euid) ||
    >> + uid_eq(pcred->euid, cred->euid) ||
    >> + capable(CAP_SYS_ADMIN);
    >> +}
    >
    > This makes absolutely no security sense whatsoever. The uid and euid of
    > the parent and child can both change between the test and the signal
    > delivery.
    >
    > There are reasons that the child signal control code is incredibly
    > careful about either the parent or child using execve or doing a
    > privilege change that might pose a risk.
    >
    > Until this code gets the same protections I don't believe it's safe.
    >
    > Alan
    >

    \
     
     \ /
      Last update: 2018-10-15 23:37    [W:4.134 / U:0.440 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site