lkml.org 
[lkml]   [2019]   [Jan]   [16]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH] Yama: Check for pid death before checking ancestry
On Wed, 16 Jan 2019, Kees Cook wrote:

> It's possible that a pid has died before we take the rcu lock, in which
> case we can't walk the ancestry list as it may be detached. Instead, check
> for death first before doing the walk.
>
> Reported-by: syzbot+a9ac39bf55329e206219@syzkaller.appspotmail.com
> Fixes: 2d514487faf1 ("security: Yama LSM")
> Cc: stable@vger.kernel.org
> Suggested-by: Oleg Nesterov <oleg@redhat.com>
> Signed-off-by: Kees Cook <keescook@chromium.org>
> ---
> James, can you please send this to Linus in your -fixes tree?

Done.

> ---
> security/yama/yama_lsm.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/security/yama/yama_lsm.c b/security/yama/yama_lsm.c
> index ffda91a4a1aa..02514fe558b4 100644
> --- a/security/yama/yama_lsm.c
> +++ b/security/yama/yama_lsm.c
> @@ -368,7 +368,9 @@ static int yama_ptrace_access_check(struct task_struct *child,
> break;
> case YAMA_SCOPE_RELATIONAL:
> rcu_read_lock();
> - if (!task_is_descendant(current, child) &&
> + if (!pid_alive(child))
> + rc = -EPERM;
> + if (!rc && !task_is_descendant(current, child) &&
> !ptracer_exception_found(current, child) &&
> !ns_capable(__task_cred(child)->user_ns, CAP_SYS_PTRACE))
> rc = -EPERM;
>

--
James Morris
<jmorris@namei.org>

\
 
 \ /
  Last update: 2019-01-16 21:03    [W:0.126 / U:0.300 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site