From: Kees Cook <keescook@chromium.org>
To: James Morris <james.l.morris@oracle.com>
Cc: LKML <linux-kernel@vger.kernel.org>,
Josh Stone <jistone@redhat.com>,
"Serge E. Hallyn" <serge@hallyn.com>,
linux-security-module <linux-security-module@vger.kernel.org>
Subject: Re: [PATCH] Yama: allow access for the current ptrace parent
Date: Fri, 2 Dec 2016 15:27:46 -0800 [thread overview]
Message-ID: <CAGXu5jKcx028GkcqsDzHBb4iWH-u2_jo5_4SrkB36gb8OpW_Hw@mail.gmail.com> (raw)
In-Reply-To: <20161201012401.17367-1-jistone@redhat.com>
On Wed, Nov 30, 2016 at 5:24 PM, Josh Stone <jistone@redhat.com> wrote:
> Under ptrace_scope=1, it's possible to have a tracee that is already
> ptrace-attached, but is no longer a direct descendant. For instance, a
> forking daemon will be re-parented to init, losing its ancestry to the
> tracer that launched it.
>
> The tracer can continue using ptrace in that state, but it will be
> denied other accesses that check PTRACE_MODE_ATTACH, like process_vm_rw
> and various procfs files. There's no reason to prevent such access for
> a tracer that already has ptrace control anyway.
>
> This patch adds a case to ptracer_exception_found to allow access for
> any task in the same thread group as the current ptrace parent.
Nice catch, thanks!
> Signed-off-by: Josh Stone <jistone@redhat.com>
> Cc: Kees Cook <keescook@chromium.org>
> Cc: James Morris <james.l.morris@oracle.com>
> Cc: "Serge E. Hallyn" <serge@hallyn.com>
> Cc: linux-security-module@vger.kernel.org
> ---
> security/yama/yama_lsm.c | 15 ++++++++++++++-
> 1 file changed, 14 insertions(+), 1 deletion(-)
>
> diff --git a/security/yama/yama_lsm.c b/security/yama/yama_lsm.c
> index 0309f2111c70..da67a6e07a60 100644
> --- a/security/yama/yama_lsm.c
> +++ b/security/yama/yama_lsm.c
> @@ -309,7 +309,7 @@ static int task_is_descendant(struct task_struct *parent,
> * @tracer: the task_struct of the process attempting ptrace
> * @tracee: the task_struct of the process to be ptraced
> *
> - * Returns 1 if tracer has is ptracer exception ancestor for tracee.
> + * Returns 1 if tracer has a ptracer exception ancestor for tracee.
> */
> static int ptracer_exception_found(struct task_struct *tracer,
> struct task_struct *tracee)
> @@ -320,6 +320,17 @@ static int ptracer_exception_found(struct task_struct *tracer,
> bool found = false;
>
> rcu_read_lock();
> +
> + /* If there's already an active tracing relationship, then make an
I'll adjust the comment style here and add it to my tree for -next.
> + * exception for the sake of other accesses, like process_vm_rw.
> + */
> + parent = ptrace_parent(tracee);
> + if (parent != NULL && same_thread_group(parent, tracer)) {
> + rc = 1;
> + goto unlock;
> + }
> +
> + /* Look for a PR_SET_PTRACER relationship. */
> if (!thread_group_leader(tracee))
> tracee = rcu_dereference(tracee->group_leader);
> list_for_each_entry_rcu(relation, &ptracer_relations, node) {
> @@ -334,6 +345,8 @@ static int ptracer_exception_found(struct task_struct *tracer,
>
> if (found && (parent == NULL || task_is_descendant(parent, tracer)))
> rc = 1;
> +
> +unlock:
> rcu_read_unlock();
>
> return rc;
> --
> 2.9.3
>
Thanks!
-Kees
--
Kees Cook
Nexus Security
next prev parent reply other threads:[~2016-12-02 23:27 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-12-01 1:24 [PATCH] Yama: allow access for the current ptrace parent Josh Stone
2016-12-02 23:27 ` Kees Cook [this message]
2016-12-05 19:13 ` Josh Stone
2016-12-05 19:38 ` Kees Cook
2016-12-02 23:49 Kees Cook
2016-12-05 0:13 ` James Morris
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=CAGXu5jKcx028GkcqsDzHBb4iWH-u2_jo5_4SrkB36gb8OpW_Hw@mail.gmail.com \
--to=keescook@chromium.org \
--cc=james.l.morris@oracle.com \
--cc=jistone@redhat.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=serge@hallyn.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).