All of lore.kernel.org
 help / color / mirror / Atom feed
From: Christian Brauner <christian.brauner@ubuntu.com>
To: Kees Cook <keescook@chromium.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>,
	Andrea Righi <andrea.righi@canonical.com>,
	stable@vger.kernel.org, linux-kernel@vger.kernel.org,
	regressions@lists.linux.dev
Subject: Re: [PATCH] proc: Track /proc/$pid/attr/ opener mm_struct
Date: Wed, 9 Jun 2021 08:40:08 +0200	[thread overview]
Message-ID: <20210609064008.liz2gvpjtyqwx6qr@wittgenstein> (raw)
In-Reply-To: <20210608171221.276899-1-keescook@chromium.org>

On Tue, Jun 08, 2021 at 10:12:21AM -0700, Kees Cook wrote:
> Commit bfb819ea20ce ("proc: Check /proc/$pid/attr/ writes against file opener")
> tried to make sure that there could not be a confusion between the opener of
> a /proc/$pid/attr/ file and the writer. It used struct cred to make sure
> the privileges didn't change. However, there were existing cases where a more
> privileged thread was passing the opened fd to a differently privileged thread
> (during container setup). Instead, use mm_struct to track whether the opener
> and writer are still the same process. (This is what several other proc files
> already do, though for different reasons.)
> 
> Reported-by: Christian Brauner <christian.brauner@ubuntu.com>
> Reported-by: Andrea Righi <andrea.righi@canonical.com>
> Tested-by: Andrea Righi <andrea.righi@canonical.com>
> Fixes: bfb819ea20ce ("proc: Check /proc/$pid/attr/ writes against file opener")
> Cc: stable@vger.kernel.org
> Signed-off-by: Kees Cook <keescook@chromium.org>
> ---

Thanks!
Acked-by: Christian Brauner <christian.brauner@ubuntu.com>

  reply	other threads:[~2021-06-09  6:40 UTC|newest]

Thread overview: 19+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-06-08 17:12 [PATCH] proc: Track /proc/$pid/attr/ opener mm_struct Kees Cook
2021-06-09  6:40 ` Christian Brauner [this message]
2021-06-14 10:02 ` youling257
2021-06-14 15:32   ` Kees Cook
2021-06-14 16:45     ` Kees Cook
2021-06-14 18:02       ` Linus Torvalds
2021-06-14 18:02         ` Linus Torvalds
2021-06-14 18:46       ` youling 257
2021-06-14 18:46         ` youling 257
2021-06-14 22:50         ` Kees Cook
2021-06-15  1:55           ` youling 257
2021-06-15  1:55             ` youling 257
2021-06-15 18:19             ` Linus Torvalds
2021-06-15 18:19               ` Linus Torvalds
2021-06-15 21:50               ` Kees Cook
2021-06-16  5:56                 ` Greg KH
2021-06-16  5:15               ` youling 257
2021-06-16  5:15                 ` youling 257
2021-06-14 17:52     ` Casey Schaufler

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20210609064008.liz2gvpjtyqwx6qr@wittgenstein \
    --to=christian.brauner@ubuntu.com \
    --cc=andrea.righi@canonical.com \
    --cc=keescook@chromium.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=regressions@lists.linux.dev \
    --cc=stable@vger.kernel.org \
    --cc=torvalds@linux-foundation.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.