|
 |
aa34b4a |
Allow threads other than the main thread to do introspection of files in
|
|
|
aa34b4a |
proc without relying on read permissions. proc_pid_follow_link() calls
|
|
|
aa34b4a |
proc_fd_access_allowed() which ultimately calls __ptrace_may_access().
|
|
|
aa34b4a |
|
|
|
aa34b4a |
Though this allows additional access to some proc files, we do not
|
|
|
aa34b4a |
believe that this has any unintended security implications. However it
|
|
|
aa34b4a |
probably needs to be looked at carefully.
|
|
|
aa34b4a |
|
|
|
aa34b4a |
The original problem was a thread of a process whose permissions were
|
|
|
aa34b4a |
111 couldn't open its own /proc/self/exe This was interfering with a
|
|
|
aa34b4a |
special purpose debugging tool. A simple reproducer is below.:
|
|
|
aa34b4a |
|
|
|
aa34b4a |
#include <pthread.h>
|
|
|
aa34b4a |
#include <unistd.h>
|
|
|
aa34b4a |
#include <stdio.h>
|
|
|
aa34b4a |
#include <errno.h>
|
|
|
aa34b4a |
#include <stdlib.h>
|
|
|
aa34b4a |
#include <sys/types.h>
|
|
|
aa34b4a |
|
|
|
aa34b4a |
#define BUFSIZE 2048
|
|
|
aa34b4a |
|
|
|
aa34b4a |
void *thread_main(void *arg){
|
|
|
aa34b4a |
char *str=(char*)arg;
|
|
|
aa34b4a |
char buf[BUFSIZE];
|
|
|
aa34b4a |
ssize_t len=readlink("/proc/self/exe", buf, BUFSIZE);
|
|
|
aa34b4a |
if(len==-1)
|
|
|
aa34b4a |
printf("/proc/self/exe in %s: %s\n", str,sys_errlist[errno]);
|
|
|
aa34b4a |
else
|
|
|
aa34b4a |
printf("/proc/self/exe in %s: OK\n", str);
|
|
|
aa34b4a |
|
|
|
aa34b4a |
return 0;
|
|
|
aa34b4a |
}
|
|
|
aa34b4a |
|
|
|
aa34b4a |
int main(){
|
|
|
aa34b4a |
pthread_t thread;
|
|
|
aa34b4a |
|
|
|
aa34b4a |
int retval=pthread_create( &thread, NULL, thread_main, "thread");
|
|
|
aa34b4a |
if(retval!=0)
|
|
|
aa34b4a |
exit(1);
|
|
|
aa34b4a |
|
|
|
aa34b4a |
thread_main("main");
|
|
|
aa34b4a |
pthread_join(thread, NULL);
|
|
|
aa34b4a |
|
|
|
aa34b4a |
exit(0);
|
|
|
aa34b4a |
}
|
|
|
aa34b4a |
|
|
|
aa34b4a |
Signed-off-by: Ben Woodard <woodard@redhat.com>
|
|
|
aa34b4a |
Signed-off-by: Mark Grondona <mgrondona@llnl.gov>
|
|
|
aa34b4a |
---
|
|
|
aa34b4a |
kernel/ptrace.c | 2 +-
|
|
|
aa34b4a |
1 file changed, 1 insertion(+), 1 deletion(-)
|
|
|
aa34b4a |
|
|
|
aa34b4a |
diff --git a/kernel/ptrace.c b/kernel/ptrace.c
|
|
|
aa34b4a |
index acbd284..347c4c7 100644
|
|
|
aa34b4a |
--- a/kernel/ptrace.c
|
|
|
aa34b4a |
+++ b/kernel/ptrace.c
|
|
|
aa34b4a |
diff -ruNp linux-3.8.4-103.fc17.noarch/kernel/ptrace.c linux-3.8.4-103.fc17.ptrace/kernel/ptrace.c
|
|
|
aa34b4a |
--- linux-3.8.4-103.fc17.noarch/kernel/ptrace.c 2013-02-18 17:58:34.000000000 -0600
|
|
|
aa34b4a |
+++ linux-3.8.4-103.fc17.ptrace/kernel/ptrace.c 2013-03-26 14:59:01.939396346 -0500
|
|
|
aa34b4a |
@@ -234,7 +234,7 @@ static int __ptrace_may_access(struct ta
|
|
|
aa34b4a |
*/
|
|
|
aa34b4a |
int dumpable = 0;
|
|
|
aa34b4a |
/* Don't let security modules deny introspection */
|
|
|
aa34b4a |
- if (task == current)
|
|
|
aa34b4a |
+ if (same_thread_group(task, current))
|
|
|
aa34b4a |
return 0;
|
|
|
aa34b4a |
rcu_read_lock();
|
|
|
aa34b4a |
tcred = __task_cred(task);
|
|
|
aa34b4a |
--
|
|
|
aa34b4a |
1.8.1.4
|
|
|
aa34b4a |
|
|
|
aa34b4a |
--
|
|
|
aa34b4a |
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
|
|
|
aa34b4a |
the body of a message to majordomo@vger.kernel.org
|
|
|
aa34b4a |
More majordomo info at http://vger.kernel.org/majordomo-info.html
|
|
|
aa34b4a |
Please read the FAQ at http://www.tux.org/lkml/
|