From: Frederic Weisbecker <frederic@kernel.org>
To: Thomas Gleixner <tglx@linutronix.de>
Cc: LKML <linux-kernel@vger.kernel.org>,
Frederic Weisbecker <fweisbec@gmail.com>,
Peter Zijlstra <peterz@infradead.org>,
Ingo Molnar <mingo@kernel.org>, Oleg Nesterov <oleg@redhat.com>,
Michael Kerrisk <mtk.manpages@googlemail.com>,
Kees Cook <keescook@chromium.org>
Subject: Re: [patch V2 6/6] posix-cpu-timers: Return -EPERM if ptrace permission check fails
Date: Mon, 23 Sep 2019 17:46:12 +0200 [thread overview]
Message-ID: <20190923154611.GB11264@lenoir> (raw)
In-Reply-To: <20190923145528.963075294@linutronix.de>
On Mon, Sep 23, 2019 at 04:54:41PM +0200, Thomas Gleixner wrote:
> Returning -EINVAL when a permission check fails is not really intuitive and
> can cause hard to diagnose problems.
>
> The POSIX specification for clock_gettime() and timer_create() requires to
> obtain the clock id first by invoking clock_getcpuclockid().
>
> clock_getcpuclockid() can return -EPERM if the caller does not have
> permissions. That does not make sense in two aspects:
>
> - Nothing prevents the caller to make up a clockid and feed it into the
> syscalls
>
> - clock_getcpuclockid() is a helper function in glibc which just mangles
> the PID/TID bits to the proper place and glibc cannot do any permission
> checks at all for this function.
>
> In order to prevent abuse the kernel has to do the permission checking in
> timer_create() and clock_gettime(). Those functions have only -EINVAL as
> documented return values, but returning -EINVAL for a valid clockid when
> the permission check fails is not understandable for programmers.
>
> So ignore the POSIX specification and return -EPERM when the ptrace
> permission check fails.
>
> Suggested-by: Peter Zijlstra <peterz@infradead.org>
> Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Frederic Weisbecker <frederic@kernel.org>
prev parent reply other threads:[~2019-09-23 15:46 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-09-23 14:54 [patch V2 0/6] posix-cpu-timers: Fix bogus permission checks Thomas Gleixner
2019-09-23 14:54 ` [patch V2 1/6] posix-cpu-timers: Restrict timer_create() permissions Thomas Gleixner
2019-09-23 14:54 ` [patch V2 2/6] posix-cpu-timers: Restrict clock_gettime() permissions Thomas Gleixner
2019-09-23 14:54 ` [patch V2 3/6] posix-cpu-timers: Sanitize thread clock permissions Thomas Gleixner
2019-09-23 14:54 ` [patch V2 4/6] posix-cpu-timers: Make PID=0 and PID=self handling consistent Thomas Gleixner
2019-09-23 14:54 ` [patch V2 5/6] posix-cpu-timers: Return PTR_ERR() from lookup_task() Thomas Gleixner
2019-09-23 15:43 ` Frederic Weisbecker
2019-09-23 14:54 ` [patch V2 6/6] posix-cpu-timers: Return -EPERM if ptrace permission check fails Thomas Gleixner
2019-09-23 15:46 ` Frederic Weisbecker [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190923154611.GB11264@lenoir \
--to=frederic@kernel.org \
--cc=fweisbec@gmail.com \
--cc=keescook@chromium.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mingo@kernel.org \
--cc=mtk.manpages@googlemail.com \
--cc=oleg@redhat.com \
--cc=peterz@infradead.org \
--cc=tglx@linutronix.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).