lkml.org 
[lkml]   [2022]   [May]   [16]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.17 030/114] procfs: prevent unprivileged processes accessing fdinfo dir
    Date
    From: Kalesh Singh <kaleshsingh@google.com>

    [ Upstream commit 1927e498aee1757b3df755a194cbfc5cc0f2b663 ]

    The file permissions on the fdinfo dir from were changed from
    S_IRUSR|S_IXUSR to S_IRUGO|S_IXUGO, and a PTRACE_MODE_READ check was added
    for opening the fdinfo files [1]. However, the ptrace permission check
    was not added to the directory, allowing anyone to get the open FD numbers
    by reading the fdinfo directory.

    Add the missing ptrace permission check for opening the fdinfo directory.

    [1] https://lkml.kernel.org/r/20210308170651.919148-1-kaleshsingh@google.com

    Link: https://lkml.kernel.org/r/20210713162008.1056986-1-kaleshsingh@google.com
    Fixes: 7bc3fa0172a4 ("procfs: allow reading fdinfo with PTRACE_MODE_READ")
    Signed-off-by: Kalesh Singh <kaleshsingh@google.com>
    Cc: Kees Cook <keescook@chromium.org>
    Cc: Eric W. Biederman <ebiederm@xmission.com>
    Cc: Christian Brauner <christian.brauner@ubuntu.com>
    Cc: Suren Baghdasaryan <surenb@google.com>
    Cc: Hridya Valsaraju <hridya@google.com>
    Cc: Jann Horn <jannh@google.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    fs/proc/fd.c | 23 ++++++++++++++++++++++-
    1 file changed, 22 insertions(+), 1 deletion(-)

    diff --git a/fs/proc/fd.c b/fs/proc/fd.c
    index 172c86270b31..913bef0d2a36 100644
    --- a/fs/proc/fd.c
    +++ b/fs/proc/fd.c
    @@ -72,7 +72,7 @@ static int seq_show(struct seq_file *m, void *v)
    return 0;
    }

    -static int seq_fdinfo_open(struct inode *inode, struct file *file)
    +static int proc_fdinfo_access_allowed(struct inode *inode)
    {
    bool allowed = false;
    struct task_struct *task = get_proc_task(inode);
    @@ -86,6 +86,16 @@ static int seq_fdinfo_open(struct inode *inode, struct file *file)
    if (!allowed)
    return -EACCES;

    + return 0;
    +}
    +
    +static int seq_fdinfo_open(struct inode *inode, struct file *file)
    +{
    + int ret = proc_fdinfo_access_allowed(inode);
    +
    + if (ret)
    + return ret;
    +
    return single_open(file, seq_show, inode);
    }

    @@ -348,12 +358,23 @@ static int proc_readfdinfo(struct file *file, struct dir_context *ctx)
    proc_fdinfo_instantiate);
    }

    +static int proc_open_fdinfo(struct inode *inode, struct file *file)
    +{
    + int ret = proc_fdinfo_access_allowed(inode);
    +
    + if (ret)
    + return ret;
    +
    + return 0;
    +}
    +
    const struct inode_operations proc_fdinfo_inode_operations = {
    .lookup = proc_lookupfdinfo,
    .setattr = proc_setattr,
    };

    const struct file_operations proc_fdinfo_operations = {
    + .open = proc_open_fdinfo,
    .read = generic_read_dir,
    .iterate_shared = proc_readfdinfo,
    .llseek = generic_file_llseek,
    --
    2.35.1


    \
     
     \ /
      Last update: 2022-05-16 22:29    [W:4.227 / U:0.072 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site