Messages in this thread | | | Date | Thu, 17 Jan 2019 07:02:34 +1100 (AEDT) | From | James Morris <> | Subject | Re: [PATCH] Yama: Check for pid death before checking ancestry |
| |
On Wed, 16 Jan 2019, Kees Cook wrote:
> It's possible that a pid has died before we take the rcu lock, in which > case we can't walk the ancestry list as it may be detached. Instead, check > for death first before doing the walk. > > Reported-by: syzbot+a9ac39bf55329e206219@syzkaller.appspotmail.com > Fixes: 2d514487faf1 ("security: Yama LSM") > Cc: stable@vger.kernel.org > Suggested-by: Oleg Nesterov <oleg@redhat.com> > Signed-off-by: Kees Cook <keescook@chromium.org> > --- > James, can you please send this to Linus in your -fixes tree?
Done.
> --- > security/yama/yama_lsm.c | 4 +++- > 1 file changed, 3 insertions(+), 1 deletion(-) > > diff --git a/security/yama/yama_lsm.c b/security/yama/yama_lsm.c > index ffda91a4a1aa..02514fe558b4 100644 > --- a/security/yama/yama_lsm.c > +++ b/security/yama/yama_lsm.c > @@ -368,7 +368,9 @@ static int yama_ptrace_access_check(struct task_struct *child, > break; > case YAMA_SCOPE_RELATIONAL: > rcu_read_lock(); > - if (!task_is_descendant(current, child) && > + if (!pid_alive(child)) > + rc = -EPERM; > + if (!rc && !task_is_descendant(current, child) && > !ptracer_exception_found(current, child) && > !ns_capable(__task_cred(child)->user_ns, CAP_SYS_PTRACE)) > rc = -EPERM; >
-- James Morris <jmorris@namei.org>
| |