Messages in this thread | | | From | Nicolas Viennot <> | Subject | RE: [PATCH v4 3/3] prctl: Allow ptrace capable processes to change /proc/self/exe | Date | Mon, 6 Jul 2020 17:13:35 +0000 |
| |
> > This is scary. But I believe it is safe. > > > > Reviewed-by: Serge Hallyn <serge@hallyn.com> > > > > I am a bit curious about the implications of the selinux patch. > > IIUC you are using the permission of the tracing process to execute > > the file without transition, so this is a way to work around the > > policy which might prevent the tracee from doing so. > > Given that SELinux wants to be MAC, I'm not *quite* sure that's > > considered kosher. You also are skipping the PROCESS__PTRACE to > > SECCLASS_PROCESS check which selinux_bprm_set_creds does later on. > > Again I'm just not quite sure what's considered normal there these > > days. > > > > Paul, do you have input there? > > I agree, the SELinux hook looks wrong. Building on what Christian said, this looks more like a ptrace operation than an exec operation.
Serge, Paul, Christian,
I made a PoC to demonstrate the change of /proc/self/exe without CAP_SYS_ADMIN using only ptrace and execve. You may find it here: https://github.com/nviennot/run_as_exe
What do you recommend to relax the security checks in the kernel when it comes to changing the exe link?
Nico
| |