Re: [PATCH][2.4+ptrace] fix side effects of the kmod/ptrace secfix

Re: [PATCH][2.4+ptrace] fix side effects of the kmod/ptrace secfix

[Andreas Gietl]

>  You would need to restrict cmdline access to all root processes(not only
>  suid) and maybe even to all processes with different capabilites and > 
uid/gid
>  to work around problems in such processes. But you would break even more
> system monitoring stuff this way(I've even heard shutdown is affected)

i can confirm that shutdown (halt|reboot) does not work on my 2.4.21-rc1-ac1 
boxes. (gentoo + redhat).

But your patch does not seem to fix it.

-- 
e-admin internet gmbh
Andreas Gietl                                            tel +49 941 3810884
Ludwig-Thoma-Strasse 35                      fax +49 89 244329104
93051 Regensburg                                  mobil +49 171 6070008

PGP/GPG-Key unter http://www.e-admin.de/gpg.html

[PATCH][2.4-rc1] fix side effects of the kmod/ptrace secfix

[Bernhard Kaindl]

[-- Attachment #1: Type: TEXT/PLAIN, Size: 1295 bytes --]

On Fri, 25 Apr 2003, Andreas Gietl wrote:
> > system monitoring stuff this way(I've even heard shutdown is affected)
>
> i can confirm that shutdown (halt|reboot) does not work on my 2.4.21-rc1-ac1
> boxes. (gentoo + redhat).

Thanks for the info!

> But your patch does not seem to fix it.

Very interesting also, the two liner adressed only the well-known problems.
To fix the other not so well-known side effects, a real cleanup is the way
to go.

Can you try the attached cleanup patch instead of the two-liner?

It's an inital cleanup and should fix the other side effects which
I described in my mails.

Bernhard Kaindl

PS: If either patch is applied correctly, this

	su guest -c 'ps $PPID;wc -m </proc/$PPID/cmdline'

should give:

  PID TTY      STAT   TIME COMMAND
 2452 pts/2    S      0:00 su bin -c ps $PPID;wc -m </proc/$PPID/cmdline
     46

If it does not, access_process_vm is not fixed properly.

Second, calling this as root:

	strace -fewrite su -c /bin/echo 2>&1 | grep pid

should give:

[pid  2599] --- SIGSTOP (Stopped (signal)) @ 0 (0) ---
[pid  2599] write(1, "\n", 1

If it does not, ptrace_check_attach is not fixed properly.

(These are only the checks for the well known side
effects which should be fixed even with the short
is_dumpable() -> task_dumpable patch.)

[-- Attachment #2: Type: TEXT/PLAIN, Size: 895 bytes --]

--- kernel/ptrace.c	2003/04/22 21:14:20	1.1
+++ kernel/ptrace.c	2003/04/25 06:21:16	1.3
@@ -21,9 +21,6 @@
  */
 int ptrace_check_attach(struct task_struct *child, int kill)
 {
-	mb();
-	if (!is_dumpable(child))
-		return -EPERM;
 
 	if (!(child->ptrace & PT_PTRACED))
 		return -ESRCH;
@@ -127,8 +124,6 @@ int access_process_vm(struct task_struct
 	/* Worry about races with exit() */
 	task_lock(tsk);
 	mm = tsk->mm;
-	if (!is_dumpable(tsk) || (&init_mm == mm))
-		mm = NULL;
 	if (mm)
 		atomic_inc(&mm->mm_users);
 	task_unlock(tsk);
--- kernel/sys.c	2003/04/25 06:23:15	1.1
+++ kernel/sys.c	2003/04/25 06:23:51
@@ -1252,8 +1252,7 @@ asmlinkage long sys_prctl(int option, un
 				error = -EINVAL;
 				break;
 			}
-			if (is_dumpable(current))
-				current->mm->dumpable = arg2;
+			current->mm->dumpable = arg2;
 			break;
 
 	        case PR_SET_UNALIGN:

Re: [PATCH][2.4-rc1] fix side effects of the kmod/ptrace secfix

[Bernhard Kaindl]

On Fri, 25 Apr 2003, Andreas Gietl wrote:
>
> it shows:
>   PID TTY      STAT   TIME COMMAND
>  2092 ttyp0    S      0:00 su guest -c ps $PPID;wc -m </proc/$PPID/cmdline
>       0

Ah ok, I tested this with LC_CTYPE=de_DE.UTF-8, in this case wc has
to read the contents of the file. When a single-byte locale is used,
wc just does fstat64() to get the file size(which returns 0 for the file).

> but cat shows:
> su guest -c 'ps $PPID; cat /proc/$PPID/cmdline'
>   PID TTY      STAT   TIME COMMAND
>  2144 ttyp0    S      0:00 su guest -c ps $PPID; cat /proc/$PPID/cmdline
> suguest-cps $PPID; cat /proc/$PPID/cmdline
>
> what happened?

This is ok, access_proces_vm() is working.

> > [pid  2599] --- SIGSTOP (Stopped (signal)) @ 0 (0) ---
> > [pid  2599] write(1, "\n", 1
>
> it shows:
> localhost root # strace -fewrite su -c /bin/echo 2>&1 | grep pid
> [pid  2159] write(1, "\n", 1

Looks ok also, the task->mm->dumpable check is removed from prace_check_attach

> Looks like my results are slightly diffent, Does this mean i did not apply the
> patch correctly? I applied it twice manually, because patch did not succeed

The above shows that at least the two-liner task_dumpable diff is applied.
> and compiled the kernel 3 times...

Sorry for the different output, I should have made my tests safer against
system variants. It should have applied clean, maybe some white space issue
or so, I'll check it. shutdown didn't change? What does it on your system?

Bernd

Re: [PATCH][2.4-rc1] fix side effects of the kmod/ptrace secfix

[Andreas Gietl]

On Friday 25 April 2003 12:40, Bernhard Kaindl wrote:
> On Fri, 25 Apr 2003, Andreas Gietl wrote:
> > > system monitoring stuff this way(I've even heard shutdown is affected)
> >
> > i can confirm that shutdown (halt|reboot) does not work on my
> > 2.4.21-rc1-ac1 boxes. (gentoo + redhat).
>
> Thanks for the info!
>
> > But your patch does not seem to fix it.
>
> Very interesting also, the two liner adressed only the well-known problems.
> To fix the other not so well-known side effects, a real cleanup is the way
> to go.
>
> Can you try the attached cleanup patch instead of the two-liner?
>
> It's an inital cleanup and should fix the other side effects which
> I described in my mails.
>
> Bernhard Kaindl
>
> PS: If either patch is applied correctly, this
>
> 	su guest -c 'ps $PPID;wc -m </proc/$PPID/cmdline'
>
> should give:
>
>   PID TTY      STAT   TIME COMMAND
>  2452 pts/2    S      0:00 su bin -c ps $PPID;wc -m </proc/$PPID/cmdline
>      46

it shows:
  PID TTY      STAT   TIME COMMAND
 2092 ttyp0    S      0:00 su guest -c ps $PPID;wc -m </proc/$PPID/cmdline
      0

but cat shows:
su guest -c 'ps $PPID; cat /proc/$PPID/cmdline'
  PID TTY      STAT   TIME COMMAND
 2144 ttyp0    S      0:00 su guest -c ps $PPID; cat /proc/$PPID/cmdline
suguest-cps $PPID; cat /proc/$PPID/cmdline

what happened?

>
> If it does not, access_process_vm is not fixed properly.
>
> Second, calling this as root:
>
> 	strace -fewrite su -c /bin/echo 2>&1 | grep pid
>
> should give:
>
> [pid  2599] --- SIGSTOP (Stopped (signal)) @ 0 (0) ---
> [pid  2599] write(1, "\n", 1

it shows:
localhost root # strace -fewrite su -c /bin/echo 2>&1 | grep pid
[pid  2159] write(1, "\n", 1

>
> If it does not, ptrace_check_attach is not fixed properly.
>
> (These are only the checks for the well known side
> effects which should be fixed even with the short
> is_dumpable() -> task_dumpable patch.)

Looks like my results are slightly diffent, Does this mean i did not apply the 
patch correctly? I applied it twice manually, because patch did not succeed 
and compiled the kernel 3 times... 

-- 
e-admin internet gmbh
Andreas Gietl                                            tel +49 941 3810884
Ludwig-Thoma-Strasse 35                      fax +49 89 244329104
93051 Regensburg                                  mobil +49 171 6070008

PGP/GPG-Key unter http://www.e-admin.de/gpg.html

Re: [PATCH][2.4-rc1] fix side effects of the kmod/ptrace secfix

[Andreas Gietl]

On Friday 25 April 2003 16:30, Bernhard Kaindl wrote:

looks like the shutdown problem was not due to a ptrace-problem, but to a 
IDE-Bug in the ac1-patch:

Hi!

Here is a first test report for 2.4.21-rc1-ac2:

*) Shutdown/Reboot problems in 2.4.21-rc1-ac1 due to
   deadlock in ide_unregister_subdriver() seem to be
   fixed!


rc1-ac2 fixed my shutdown problem.

thanx for the support

> On Fri, 25 Apr 2003, Andreas Gietl wrote:
> > it shows:
> >   PID TTY      STAT   TIME COMMAND
> >  2092 ttyp0    S      0:00 su guest -c ps $PPID;wc -m
> > </proc/$PPID/cmdline 0
>
> Ah ok, I tested this with LC_CTYPE=de_DE.UTF-8, in this case wc has
> to read the contents of the file. When a single-byte locale is used,
> wc just does fstat64() to get the file size(which returns 0 for the file).
>
> > but cat shows:
> > su guest -c 'ps $PPID; cat /proc/$PPID/cmdline'
> >   PID TTY      STAT   TIME COMMAND
> >  2144 ttyp0    S      0:00 su guest -c ps $PPID; cat /proc/$PPID/cmdline
> > suguest-cps $PPID; cat /proc/$PPID/cmdline
> >
> > what happened?
>
> This is ok, access_proces_vm() is working.
>
> > > [pid  2599] --- SIGSTOP (Stopped (signal)) @ 0 (0) ---
> > > [pid  2599] write(1, "\n", 1
> >
> > it shows:
> > localhost root # strace -fewrite su -c /bin/echo 2>&1 | grep pid
> > [pid  2159] write(1, "\n", 1
>
> Looks ok also, the task->mm->dumpable check is removed from
> prace_check_attach
>
> > Looks like my results are slightly diffent, Does this mean i did not
> > apply the patch correctly? I applied it twice manually, because patch did
> > not succeed
>
> The above shows that at least the two-liner task_dumpable diff is applied.
>
> > and compiled the kernel 3 times...
>
> Sorry for the different output, I should have made my tests safer against
> system variants. It should have applied clean, maybe some white space issue
> or so, I'll check it. shutdown didn't change? What does it on your system?
>
> Bernd
> -
> To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
> Please read the FAQ at  http://www.tux.org/lkml/

-- 
e-admin internet gmbh
Andreas Gietl                                            tel +49 941 3810884
Ludwig-Thoma-Strasse 35                      fax +49 89 244329104
93051 Regensburg                                  mobil +49 171 6070008

PGP/GPG-Key unter http://www.e-admin.de/gpg.html