Messages in this thread |  | | Date | Sat, 22 Sep 2018 12:18:44 +0200 | From | Peter Zijlstra <> | Subject | Re: [PATCH v6 0/3] Harden spectrev2 userspace-userspace protection |
| |
On Sat, Sep 22, 2018 at 11:53:14AM +0200, Thomas Gleixner wrote: > @@ -86,6 +88,7 @@ extern void exit_ptrace(struct task_stru > * process_vm_writev or ptrace (and should use the real credentials). > */ > extern bool ptrace_may_access(struct task_struct *task, unsigned int mode); > +extern bool ptrace_may_access_sched(struct task_struct *task, unsigned int mode);
I like that..
> static inline int ptrace_reparented(struct task_struct *child) > { > --- a/kernel/ptrace.c > +++ b/kernel/ptrace.c
> +bool ptrace_may_access_sched(struct task_struct *task, unsigned int mode) > +{ > + struct mm_struct *mm; > + int res; > + > + res = __ptrace_may_access_basic(task, mode); > + if (res <= 0) > + return !res; > + > + rcu_read_lock(); > + res = __ptrace_may_access_cred(__task_cred(task), mode); > rcu_read_unlock(); > + if (res) > + return false; > + > + mm = task->mm; > + if (mm && get_dumpable(mm) != SUID_DUMP_USER) > + return false; > + return true; > +} > + > +/* Returns 0 on success, -errno on denial. */ > +static int __ptrace_may_access(struct task_struct *task, unsigned int mode) > +{ > + const struct cred *tcred; > + struct mm_struct *mm; > + int res; > + > + res = __ptrace_may_access_basic(task, mode); > + if (res <= 0) > + return res; > + > + rcu_read_lock(); > + tcred = __task_cred(task); > + res = __ptrace_may_access_cred(tcred, mode); > + if (res > 0) > + res = ptrace_has_cap(tcred->user_ns, mode) ? 0 : -EPERM; > rcu_read_unlock(); > + if (res < 0) > + return res; > + > mm = task->mm; > + if (mm && (get_dumpable(mm) != SUID_DUMP_USER && > + !ptrace_has_cap(mm->user_ns, mode))) > + return -EPERM; > > return security_ptrace_access_check(task, mode); > }
This has some unfortunate duplication.
Lets go with it for now, but I'll see if I can do something about that later.
|  |