Yama: Check for pid death before checking ancestry
Subsystems (2)
PATCH 1/1 Yama: Check for pid death before checking ancestry
It's possible that a pid has died before we take the rcu lock, in which case we can't walk the ancestry list as it may be detached. Instead, check for death first before doing the walk.
---
James, can you please send this to Linus in your -fixes tree?
--- security/yama/yama_lsm.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
security/yama/yama_lsm.c +3 -1
@@ -368,7 +368,9 @@ static int yama_ptrace_access_check(struct task_struct *child,break ;case YAMA_SCOPE_RELATIONAL :rcu_read_lock (); -if (!task_is_descendant (current, child) && +if (!pid_alive (child)) + rc = -EPERM ; +if (!rc && !task_is_descendant (current, child) && !ptracer_exception_found (current, child) && !ns_capable (__task_cred (child)->user_ns,CAP_SYS_PTRACE )) rc = -EPERM ;
Signature · 5 lines
2.17.1 -- Kees Cook
James Morris
maintainerQuoted 11 lines · Kees Cook
It's possible that a pid has died before we take the rcu lock, in which case we can't walk the ancestry list as it may be detached. Instead, check for death first before doing the walk.
Reported-by [email protected]Fixes 2d514487faf1 ("security: Yama LSM")Suggested-by Oleg Nesterov <[email protected]>Signed-off-by Kees Cook <[email protected]>---
James, can you please send this to Linus in your -fixes tree?
Done.
Quoted 20 lines
--- security/yama/yama_lsm.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)security/yama/yama_lsm.c +3
-1@@ -368,7 +368,9 @@ static int yama_ptrace_access_check(struct task_struct *child,break ;case YAMA_SCOPE_RELATIONAL :rcu_read_lock (); -if (!task_is_descendant (current, child) && +if (!pid_alive (child)) + rc = -EPERM ; +if (!rc && !task_is_descendant (current, child) && !ptracer_exception_found (current, child) && !ns_capable (__task_cred (child)->user_ns,CAP_SYS_PTRACE )) rc = -EPERM ;
Signature · 2 lines
James Morris <[email protected]>
James Morris
maintainerQuoted 14 lines · James Morris
Quoted 11 lines · Kees Cook
It's possible that a pid has died before we take the rcu lock, in which case we can't walk the ancestry list as it may be detached. Instead, check for death first before doing the walk.
Reported-by [email protected]Fixes 2d514487faf1 ("security: Yama LSM")Suggested-by Oleg Nesterov <[email protected]>Signed-off-by Kees Cook <[email protected]>---
James, can you please send this to Linus in your -fixes tree?
Quoted 1 line
Done.
I mean, queued in that tree.
Quoted 23 lines
Quoted 21 lines
--- security/yama/yama_lsm.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)security/yama/yama_lsm.c +3
-1@@ -368,7 +368,9 @@ static int yama_ptrace_access_check(struct task_struct *child,break ;case YAMA_SCOPE_RELATIONAL :rcu_read_lock (); -if (!task_is_descendant (current, child) && +if (!pid_alive (child)) + rc = -EPERM ; +if (!rc && !task_is_descendant (current, child) && !ptracer_exception_found (current, child) && !ns_capable (__task_cred (child)->user_ns,CAP_SYS_PTRACE )) rc = -EPERM ;
Signature · 2 lines
James Morris <[email protected]>