* Re: [PATCH][2.4+ptrace] fix side effects of the kmod/ptrace secfix @ 2003-04-24 22:37 Andreas Gietl 2003-04-25 10:40 ` [PATCH][2.4-rc1] " Bernhard Kaindl 0 siblings, 1 reply; 5+ messages in thread From: Andreas Gietl @ 2003-04-24 22:37 UTC (permalink / raw) To: Linux Kernel Mailing List; +Cc: bernhard.kaindl > You would need to restrict cmdline access to all root processes(not only > suid) and maybe even to all processes with different capabilites and > uid/gid > to work around problems in such processes. But you would break even more > system monitoring stuff this way(I've even heard shutdown is affected) i can confirm that shutdown (halt|reboot) does not work on my 2.4.21-rc1-ac1 boxes. (gentoo + redhat). But your patch does not seem to fix it. -- e-admin internet gmbh Andreas Gietl tel +49 941 3810884 Ludwig-Thoma-Strasse 35 fax +49 89 244329104 93051 Regensburg mobil +49 171 6070008 PGP/GPG-Key unter http://www.e-admin.de/gpg.html ^ permalink raw reply [flat|nested] 5+ messages in thread
* [PATCH][2.4-rc1] fix side effects of the kmod/ptrace secfix 2003-04-24 22:37 [PATCH][2.4+ptrace] fix side effects of the kmod/ptrace secfix Andreas Gietl @ 2003-04-25 10:40 ` Bernhard Kaindl 2003-04-25 14:40 ` Andreas Gietl 0 siblings, 1 reply; 5+ messages in thread From: Bernhard Kaindl @ 2003-04-25 10:40 UTC (permalink / raw) To: Andreas Gietl; +Cc: Linux Kernel Mailing List [-- Attachment #1: Type: TEXT/PLAIN, Size: 1295 bytes --] On Fri, 25 Apr 2003, Andreas Gietl wrote: > > system monitoring stuff this way(I've even heard shutdown is affected) > > i can confirm that shutdown (halt|reboot) does not work on my 2.4.21-rc1-ac1 > boxes. (gentoo + redhat). Thanks for the info! > But your patch does not seem to fix it. Very interesting also, the two liner adressed only the well-known problems. To fix the other not so well-known side effects, a real cleanup is the way to go. Can you try the attached cleanup patch instead of the two-liner? It's an inital cleanup and should fix the other side effects which I described in my mails. Bernhard Kaindl PS: If either patch is applied correctly, this su guest -c 'ps $PPID;wc -m </proc/$PPID/cmdline' should give: PID TTY STAT TIME COMMAND 2452 pts/2 S 0:00 su bin -c ps $PPID;wc -m </proc/$PPID/cmdline 46 If it does not, access_process_vm is not fixed properly. Second, calling this as root: strace -fewrite su -c /bin/echo 2>&1 | grep pid should give: [pid 2599] --- SIGSTOP (Stopped (signal)) @ 0 (0) --- [pid 2599] write(1, "\n", 1 If it does not, ptrace_check_attach is not fixed properly. (These are only the checks for the well known side effects which should be fixed even with the short is_dumpable() -> task_dumpable patch.) [-- Attachment #2: Type: TEXT/PLAIN, Size: 895 bytes --] --- kernel/ptrace.c 2003/04/22 21:14:20 1.1 +++ kernel/ptrace.c 2003/04/25 06:21:16 1.3 @@ -21,9 +21,6 @@ */ int ptrace_check_attach(struct task_struct *child, int kill) { - mb(); - if (!is_dumpable(child)) - return -EPERM; if (!(child->ptrace & PT_PTRACED)) return -ESRCH; @@ -127,8 +124,6 @@ int access_process_vm(struct task_struct /* Worry about races with exit() */ task_lock(tsk); mm = tsk->mm; - if (!is_dumpable(tsk) || (&init_mm == mm)) - mm = NULL; if (mm) atomic_inc(&mm->mm_users); task_unlock(tsk); --- kernel/sys.c 2003/04/25 06:23:15 1.1 +++ kernel/sys.c 2003/04/25 06:23:51 @@ -1252,8 +1252,7 @@ asmlinkage long sys_prctl(int option, un error = -EINVAL; break; } - if (is_dumpable(current)) - current->mm->dumpable = arg2; + current->mm->dumpable = arg2; break; case PR_SET_UNALIGN: ^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH][2.4-rc1] fix side effects of the kmod/ptrace secfix 2003-04-25 10:40 ` [PATCH][2.4-rc1] " Bernhard Kaindl @ 2003-04-25 14:40 ` Andreas Gietl 2003-04-25 14:30 ` Bernhard Kaindl 0 siblings, 1 reply; 5+ messages in thread From: Andreas Gietl @ 2003-04-25 14:40 UTC (permalink / raw) To: Bernhard Kaindl; +Cc: Linux Kernel Mailing List On Friday 25 April 2003 12:40, Bernhard Kaindl wrote: > On Fri, 25 Apr 2003, Andreas Gietl wrote: > > > system monitoring stuff this way(I've even heard shutdown is affected) > > > > i can confirm that shutdown (halt|reboot) does not work on my > > 2.4.21-rc1-ac1 boxes. (gentoo + redhat). > > Thanks for the info! > > > But your patch does not seem to fix it. > > Very interesting also, the two liner adressed only the well-known problems. > To fix the other not so well-known side effects, a real cleanup is the way > to go. > > Can you try the attached cleanup patch instead of the two-liner? > > It's an inital cleanup and should fix the other side effects which > I described in my mails. > > Bernhard Kaindl > > PS: If either patch is applied correctly, this > > su guest -c 'ps $PPID;wc -m </proc/$PPID/cmdline' > > should give: > > PID TTY STAT TIME COMMAND > 2452 pts/2 S 0:00 su bin -c ps $PPID;wc -m </proc/$PPID/cmdline > 46 it shows: PID TTY STAT TIME COMMAND 2092 ttyp0 S 0:00 su guest -c ps $PPID;wc -m </proc/$PPID/cmdline 0 but cat shows: su guest -c 'ps $PPID; cat /proc/$PPID/cmdline' PID TTY STAT TIME COMMAND 2144 ttyp0 S 0:00 su guest -c ps $PPID; cat /proc/$PPID/cmdline suguest-cps $PPID; cat /proc/$PPID/cmdline what happened? > > If it does not, access_process_vm is not fixed properly. > > Second, calling this as root: > > strace -fewrite su -c /bin/echo 2>&1 | grep pid > > should give: > > [pid 2599] --- SIGSTOP (Stopped (signal)) @ 0 (0) --- > [pid 2599] write(1, "\n", 1 it shows: localhost root # strace -fewrite su -c /bin/echo 2>&1 | grep pid [pid 2159] write(1, "\n", 1 > > If it does not, ptrace_check_attach is not fixed properly. > > (These are only the checks for the well known side > effects which should be fixed even with the short > is_dumpable() -> task_dumpable patch.) Looks like my results are slightly diffent, Does this mean i did not apply the patch correctly? I applied it twice manually, because patch did not succeed and compiled the kernel 3 times... -- e-admin internet gmbh Andreas Gietl tel +49 941 3810884 Ludwig-Thoma-Strasse 35 fax +49 89 244329104 93051 Regensburg mobil +49 171 6070008 PGP/GPG-Key unter http://www.e-admin.de/gpg.html ^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH][2.4-rc1] fix side effects of the kmod/ptrace secfix 2003-04-25 14:40 ` Andreas Gietl @ 2003-04-25 14:30 ` Bernhard Kaindl 2003-04-26 16:58 ` Andreas Gietl 0 siblings, 1 reply; 5+ messages in thread From: Bernhard Kaindl @ 2003-04-25 14:30 UTC (permalink / raw) To: Andreas Gietl; +Cc: Linux Kernel Mailing List On Fri, 25 Apr 2003, Andreas Gietl wrote: > > it shows: > PID TTY STAT TIME COMMAND > 2092 ttyp0 S 0:00 su guest -c ps $PPID;wc -m </proc/$PPID/cmdline > 0 Ah ok, I tested this with LC_CTYPE=de_DE.UTF-8, in this case wc has to read the contents of the file. When a single-byte locale is used, wc just does fstat64() to get the file size(which returns 0 for the file). > but cat shows: > su guest -c 'ps $PPID; cat /proc/$PPID/cmdline' > PID TTY STAT TIME COMMAND > 2144 ttyp0 S 0:00 su guest -c ps $PPID; cat /proc/$PPID/cmdline > suguest-cps $PPID; cat /proc/$PPID/cmdline > > what happened? This is ok, access_proces_vm() is working. > > [pid 2599] --- SIGSTOP (Stopped (signal)) @ 0 (0) --- > > [pid 2599] write(1, "\n", 1 > > it shows: > localhost root # strace -fewrite su -c /bin/echo 2>&1 | grep pid > [pid 2159] write(1, "\n", 1 Looks ok also, the task->mm->dumpable check is removed from prace_check_attach > Looks like my results are slightly diffent, Does this mean i did not apply the > patch correctly? I applied it twice manually, because patch did not succeed The above shows that at least the two-liner task_dumpable diff is applied. > and compiled the kernel 3 times... Sorry for the different output, I should have made my tests safer against system variants. It should have applied clean, maybe some white space issue or so, I'll check it. shutdown didn't change? What does it on your system? Bernd ^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH][2.4-rc1] fix side effects of the kmod/ptrace secfix 2003-04-25 14:30 ` Bernhard Kaindl @ 2003-04-26 16:58 ` Andreas Gietl 0 siblings, 0 replies; 5+ messages in thread From: Andreas Gietl @ 2003-04-26 16:58 UTC (permalink / raw) To: Bernhard Kaindl; +Cc: Linux Kernel Mailing List On Friday 25 April 2003 16:30, Bernhard Kaindl wrote: looks like the shutdown problem was not due to a ptrace-problem, but to a IDE-Bug in the ac1-patch: Hi! Here is a first test report for 2.4.21-rc1-ac2: *) Shutdown/Reboot problems in 2.4.21-rc1-ac1 due to deadlock in ide_unregister_subdriver() seem to be fixed! rc1-ac2 fixed my shutdown problem. thanx for the support > On Fri, 25 Apr 2003, Andreas Gietl wrote: > > it shows: > > PID TTY STAT TIME COMMAND > > 2092 ttyp0 S 0:00 su guest -c ps $PPID;wc -m > > </proc/$PPID/cmdline 0 > > Ah ok, I tested this with LC_CTYPE=de_DE.UTF-8, in this case wc has > to read the contents of the file. When a single-byte locale is used, > wc just does fstat64() to get the file size(which returns 0 for the file). > > > but cat shows: > > su guest -c 'ps $PPID; cat /proc/$PPID/cmdline' > > PID TTY STAT TIME COMMAND > > 2144 ttyp0 S 0:00 su guest -c ps $PPID; cat /proc/$PPID/cmdline > > suguest-cps $PPID; cat /proc/$PPID/cmdline > > > > what happened? > > This is ok, access_proces_vm() is working. > > > > [pid 2599] --- SIGSTOP (Stopped (signal)) @ 0 (0) --- > > > [pid 2599] write(1, "\n", 1 > > > > it shows: > > localhost root # strace -fewrite su -c /bin/echo 2>&1 | grep pid > > [pid 2159] write(1, "\n", 1 > > Looks ok also, the task->mm->dumpable check is removed from > prace_check_attach > > > Looks like my results are slightly diffent, Does this mean i did not > > apply the patch correctly? I applied it twice manually, because patch did > > not succeed > > The above shows that at least the two-liner task_dumpable diff is applied. > > > and compiled the kernel 3 times... > > Sorry for the different output, I should have made my tests safer against > system variants. It should have applied clean, maybe some white space issue > or so, I'll check it. shutdown didn't change? What does it on your system? > > Bernd > - > To unsubscribe from this list: send the line "unsubscribe linux-kernel" in > the body of a message to majordomo@vger.kernel.org > More majordomo info at http://vger.kernel.org/majordomo-info.html > Please read the FAQ at http://www.tux.org/lkml/ -- e-admin internet gmbh Andreas Gietl tel +49 941 3810884 Ludwig-Thoma-Strasse 35 fax +49 89 244329104 93051 Regensburg mobil +49 171 6070008 PGP/GPG-Key unter http://www.e-admin.de/gpg.html ^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2003-04-26 16:46 UTC | newest] Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed) -- links below jump to the message on this page -- 2003-04-24 22:37 [PATCH][2.4+ptrace] fix side effects of the kmod/ptrace secfix Andreas Gietl 2003-04-25 10:40 ` [PATCH][2.4-rc1] " Bernhard Kaindl 2003-04-25 14:40 ` Andreas Gietl 2003-04-25 14:30 ` Bernhard Kaindl 2003-04-26 16:58 ` Andreas Gietl
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).