From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <linux-fsdevel-owner@vger.kernel.org>
Received: from mail-yw0-f182.google.com ([209.85.161.182]:33888 "EHLO
        mail-yw0-f182.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
        with ESMTP id S1756174AbcIRT6S (ORCPT
        <rfc822;linux-fsdevel@vger.kernel.org>);
        Sun, 18 Sep 2016 15:58:18 -0400
Received: by mail-yw0-f182.google.com with SMTP id g192so122112833ywh.1
        for <linux-fsdevel@vger.kernel.org>; Sun, 18 Sep 2016 12:58:18 -0700 (PDT)
MIME-Version: 1.0
In-Reply-To: <1474211117-16674-8-git-send-email-jann@thejh.net>
References: <1474211117-16674-1-git-send-email-jann@thejh.net> <1474211117-16674-8-git-send-email-jann@thejh.net>
From: Andy Lutomirski <luto@amacapital.net>
Date: Sun, 18 Sep 2016 12:57:57 -0700
Message-ID: <CALCETrXHCz0h-KTJOQoBcCLm50QvbJi7W5c8yjh9BxeUj8FrUA@mail.gmail.com>
Subject: Re: [PATCH 7/9] ptrace: forbid ptrace checks against current_cred()
 from VFS context
To: Jann Horn <jann@thejh.net>
Cc: Thomas Gleixner <tglx@linutronix.de>,
        Stephen Smalley <sds@tycho.nsa.gov>,
        Andrew Morton <akpm@linux-foundation.org>,
        "security@kernel.org" <security@kernel.org>,
        James Morris <james.l.morris@oracle.com>,
        Janis Danisevskis <jdanis@google.com>,
        Casey Schaufler <casey@schaufler-ca.com>,
        Kees Cook <eescook@chromium.org>,
        Roland McGrath <roland@hack.frob.com>,
        Alexander Viro <viro@zeniv.linux.org.uk>,
        LSM List <linux-security-module@vger.kernel.org>,
        "Serge E. Hallyn" <serge@hallyn.com>,
        "Eric . Biederman" <ebiederm@xmission.com>,
        Paul Moore <aul@paul-moore.com>,
        Linux FS Devel <linux-fsdevel@vger.kernel.org>,
        Oleg Nesterov <oleg@redhat.com>,
        Benjamin LaHaise <bcrl@kvack.org>,
        Eric Paris <eparis@parisplace.org>,
        Seth Forshee <seth.forshee@canonical.com>,
        John Johansen <john.johansen@canonical.com>
Content-Type: text/plain; charset=UTF-8
Sender: linux-fsdevel-owner@vger.kernel.org
List-ID: <linux-fsdevel.vger.kernel.org>

On Sep 18, 2016 5:05 AM, "Jann Horn" <jann@thejh.net> wrote:
>
> This ensures that VFS implementations don't call ptrace_may_access() from
> VFS read or write handlers. In order for file descriptor passing to have
> its intended security properties, VFS read/write handlers must not do any
> kind of privilege checking.
>

Ooh, nifty!  Can you warn about capable() too?

Warning about all access to current->cred could be fun.  I expect we
have zillions of these bugs.  Think keys, netlink, proc, etc.