From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from hapkido.dreamhost.com ([66.33.216.122]:56112 "EHLO hapkido.dreamhost.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751476AbcJBDQL (ORCPT ); Sat, 1 Oct 2016 23:16:11 -0400 Received: from homiemail-a79.g.dreamhost.com (sub5.mail.dreamhost.com [208.113.200.129]) by hapkido.dreamhost.com (Postfix) with ESMTP id 43C9EE6DC3 for ; Sat, 1 Oct 2016 20:16:11 -0700 (PDT) Received: from homiemail-a79.g.dreamhost.com (localhost [127.0.0.1]) by homiemail-a79.g.dreamhost.com (Postfix) with ESMTP id 44D7D600289F for ; Sat, 1 Oct 2016 20:16:10 -0700 (PDT) Received: from kmjvbox (unknown [198.134.93.254]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) (Authenticated sender: kjlx@templeofstupid.com) by homiemail-a79.g.dreamhost.com (Postfix) with ESMTPSA id 9010D6002826 for ; Sat, 1 Oct 2016 20:16:09 -0700 (PDT) Date: Sat, 1 Oct 2016 20:16:00 -0700 From: Krister Johansen To: Jann Horn Cc: Alexander Viro , Roland McGrath , Oleg Nesterov , John Johansen , James Morris , "Serge E. Hallyn" , Paul Moore , Stephen Smalley , Eric Paris , Casey Schaufler , Kees Cook , Andrew Morton , Janis Danisevskis , Seth Forshee , "Eric . Biederman" , Thomas Gleixner , Benjamin LaHaise , Ben Hutchings , Andy Lutomirski , Linus Torvalds , linux-fsdevel@vger.kernel.org, linux-security-module@vger.kernel.org, security@kernel.org Subject: Re: [PATCH v2 8/8] Documentation: add security/ptrace_checks.txt Message-ID: <20161002031600.GC2635@templeofstupid.com> References: <1474663238-22134-1-git-send-email-jann@thejh.net> <1474663238-22134-9-git-send-email-jann@thejh.net> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <1474663238-22134-9-git-send-email-jann@thejh.net> Sender: linux-fsdevel-owner@vger.kernel.org List-ID: On Fri, Sep 23, 2016 at 10:40:38PM +0200, Jann Horn wrote: > +===================== > +FILESYSTEM DEBUG APIS > +===================== > + > +The pid / tgid entries in procfs contain various entries that allow debugging > +access to a process. Interesting entries are: > + > + - auxv permits an ASLR bypass > + - cwd can permit bypassing filesystem restrictions in some cases > + - environ can leak secret tokens > + - fd can permit bypassing filesystem restrictions or leak access to things like > + pipes > + - maps permits an ASLR bypass > + - mem grants R+W access to process memory > + - stat permits an ASLR bypass > + > +Of these, all use both a normal filesystem DAC check (where the file owner is > +the process owner for a dumpable process, root for a nondumpable process) and a > +ptrace_may_access() check; however, the DAC check may be modified, and the > +ptrace_may_access() is performed under PTRACE_FSCREDS, meaning that instead of > +the caller's ruid, rgid and permitted capabilities, the fsuid, fsgid and > +effective capabilities are used, causing the case where a daemon drops its euid > +prior to accessing a file for the user to be treated correctly for this check. Thanks for writing this up. Is it worth mentioning some of the less obvious aspects of how user namespaces interact with the filesystem debug APIs? Of particular note: a nondumpable process will always be assigned the global root ids. Checks against capabilities for procfs require that the uid and gid have a mapping in the current namepsace. That's enforced through capable_wrt_inode_uidgid(). By way of example, if you enter a user namespace that doesn't have a mapping for the global root id, then non-dumpable processes are off limits from /proc. The global root ids get mapped to a special id for unresolved mappings. If the process that entered the namespace has CAP_DAC_OVERRIDE/CAP_DAC_READ_SEARCH, these don't suffice to grant any access to the non-dumpable process because the inode has no [ug]id mapping in the particular namespace. -K