|
 |
af63216 |
From 64a37c8197f4e1c2637cd80326f4649282176369 Mon Sep 17 00:00:00 2001
|
|
|
af63216 |
From: Jann Horn <jann@thejh.net>
|
|
|
af63216 |
Date: Sat, 26 Dec 2015 03:52:31 +0100
|
|
|
af63216 |
Subject: [PATCH] ptrace: being capable wrt a process requires mapped uids/gids
|
|
|
af63216 |
|
|
|
af63216 |
ptrace_has_cap() checks whether the current process should be
|
|
|
af63216 |
treated as having a certain capability for ptrace checks
|
|
|
af63216 |
against another process. Until now, this was equivalent to
|
|
|
af63216 |
has_ns_capability(current, target_ns, CAP_SYS_PTRACE).
|
|
|
af63216 |
|
|
|
af63216 |
However, if a root-owned process wants to enter a user
|
|
|
af63216 |
namespace for some reason without knowing who owns it and
|
|
|
af63216 |
therefore can't change to the namespace owner's uid and gid
|
|
|
af63216 |
before entering, as soon as it has entered the namespace,
|
|
|
af63216 |
the namespace owner can attach to it via ptrace and thereby
|
|
|
af63216 |
gain access to its uid and gid.
|
|
|
af63216 |
|
|
|
af63216 |
While it is possible for the entering process to switch to
|
|
|
af63216 |
the uid of a claimed namespace owner before entering,
|
|
|
af63216 |
causing the attempt to enter to fail if the claimed uid is
|
|
|
af63216 |
wrong, this doesn't solve the problem of determining an
|
|
|
af63216 |
appropriate gid.
|
|
|
af63216 |
|
|
|
af63216 |
With this change, the entering process can first enter the
|
|
|
af63216 |
namespace and then safely inspect the namespace's
|
|
|
af63216 |
properties, e.g. through /proc/self/{uid_map,gid_map},
|
|
|
af63216 |
assuming that the namespace owner doesn't have access to
|
|
|
af63216 |
uid 0.
|
|
|
af63216 |
|
|
|
af63216 |
Changed in v2: The caller needs to be capable in the
|
|
|
af63216 |
namespace into which tcred's uids/gids can be mapped.
|
|
|
af63216 |
|
|
|
af63216 |
Signed-off-by: Jann Horn <jann@thejh.net>
|
|
|
af63216 |
---
|
|
|
af63216 |
kernel/ptrace.c | 33 ++++++++++++++++++++++++++++-----
|
|
|
af63216 |
1 file changed, 28 insertions(+), 5 deletions(-)
|
|
|
af63216 |
|
|
|
af63216 |
diff --git a/kernel/ptrace.c b/kernel/ptrace.c
|
|
|
af63216 |
index 787320de68e0..407c382b45c8 100644
|
|
|
af63216 |
--- a/kernel/ptrace.c
|
|
|
af63216 |
+++ b/kernel/ptrace.c
|
|
|
af63216 |
@@ -20,6 +20,7 @@
|
|
|
af63216 |
#include <linux/uio.h>
|
|
|
af63216 |
#include <linux/audit.h>
|
|
|
af63216 |
#include <linux/pid_namespace.h>
|
|
|
af63216 |
+#include <linux/user_namespace.h>
|
|
|
af63216 |
#include <linux/syscalls.h>
|
|
|
af63216 |
#include <linux/uaccess.h>
|
|
|
af63216 |
#include <linux/regset.h>
|
|
|
af63216 |
@@ -207,12 +208,34 @@ static int ptrace_check_attach(struct task_struct *child, bool ignore_state)
|
|
|
af63216 |
return ret;
|
|
|
af63216 |
}
|
|
|
af63216 |
|
|
|
af63216 |
-static int ptrace_has_cap(struct user_namespace *ns, unsigned int mode)
|
|
|
af63216 |
+static bool ptrace_has_cap(const struct cred *tcred, unsigned int mode)
|
|
|
af63216 |
{
|
|
|
af63216 |
+ struct user_namespace *tns = tcred->user_ns;
|
|
|
af63216 |
+
|
|
|
af63216 |
+ /* When a root-owned process enters a user namespace created by a
|
|
|
af63216 |
+ * malicious user, the user shouldn't be able to execute code under
|
|
|
af63216 |
+ * uid 0 by attaching to the root-owned process via ptrace.
|
|
|
af63216 |
+ * Therefore, similar to the capable_wrt_inode_uidgid() check,
|
|
|
af63216 |
+ * verify that all the uids and gids of the target process are
|
|
|
af63216 |
+ * mapped into a namespace below the current one in which the caller
|
|
|
af63216 |
+ * is capable.
|
|
|
af63216 |
+ * No fsuid/fsgid check because __ptrace_may_access doesn't do it
|
|
|
af63216 |
+ * either.
|
|
|
af63216 |
+ */
|
|
|
af63216 |
+ while (
|
|
|
af63216 |
+ !kuid_has_mapping(tns, tcred->euid) ||
|
|
|
af63216 |
+ !kuid_has_mapping(tns, tcred->suid) ||
|
|
|
af63216 |
+ !kuid_has_mapping(tns, tcred->uid) ||
|
|
|
af63216 |
+ !kgid_has_mapping(tns, tcred->egid) ||
|
|
|
af63216 |
+ !kgid_has_mapping(tns, tcred->sgid) ||
|
|
|
af63216 |
+ !kgid_has_mapping(tns, tcred->gid)) {
|
|
|
af63216 |
+ tns = tns->parent;
|
|
|
af63216 |
+ }
|
|
|
af63216 |
+
|
|
|
af63216 |
if (mode & PTRACE_MODE_NOAUDIT)
|
|
|
af63216 |
- return has_ns_capability_noaudit(current, ns, CAP_SYS_PTRACE);
|
|
|
af63216 |
+ return has_ns_capability_noaudit(current, tns, CAP_SYS_PTRACE);
|
|
|
af63216 |
else
|
|
|
af63216 |
- return has_ns_capability(current, ns, CAP_SYS_PTRACE);
|
|
|
af63216 |
+ return has_ns_capability(current, tns, CAP_SYS_PTRACE);
|
|
|
af63216 |
}
|
|
|
af63216 |
|
|
|
af63216 |
/* Returns 0 on success, -errno on denial. */
|
|
|
af63216 |
@@ -241,7 +264,7 @@ static int __ptrace_may_access(struct task_struct *task, unsigned int mode)
|
|
|
af63216 |
gid_eq(cred->gid, tcred->sgid) &&
|
|
|
af63216 |
gid_eq(cred->gid, tcred->gid))
|
|
|
af63216 |
goto ok;
|
|
|
af63216 |
- if (ptrace_has_cap(tcred->user_ns, mode))
|
|
|
af63216 |
+ if (ptrace_has_cap(tcred, mode))
|
|
|
af63216 |
goto ok;
|
|
|
af63216 |
rcu_read_unlock();
|
|
|
af63216 |
return -EPERM;
|
|
|
af63216 |
@@ -252,7 +275,7 @@ ok:
|
|
|
af63216 |
dumpable = get_dumpable(task->mm);
|
|
|
af63216 |
rcu_read_lock();
|
|
|
af63216 |
if (dumpable != SUID_DUMP_USER &&
|
|
|
af63216 |
- !ptrace_has_cap(__task_cred(task)->user_ns, mode)) {
|
|
|
af63216 |
+ !ptrace_has_cap(__task_cred(task), mode)) {
|
|
|
af63216 |
rcu_read_unlock();
|
|
|
af63216 |
return -EPERM;
|
|
|
af63216 |
}
|
|
|
af63216 |
--
|
|
|
af63216 |
2.5.0
|
|
|
af63216 |
|