Skip to contentSkip to conversation

ptrace: Properly initialize ptracer_cred on fork

PATCH In review Eric W. Biederman 2 participants 2 messages May 24, 2017 – May 25, 2017

Subsystems (2)
Stable branch ptrace support
lore
Share & tools
lore

Eric W. Biederman

author
#0 lore raw

PATCH 1/1 ptrace: Properly initialize ptracer_cred on fork

Enlightenment is broken in 4.11 and possibly other kernels where commit 64b875f7ac8a ("ptrace: Capture the ptracer's creds not PT_PTRACE_CAP") is backported to.

Can you please backport commit c70d9d809fde ("ptrace: Properly initialize ptracer_cred on fork") to the appropriate kernels.

Thank you,

Eric Beiderman

Quoted 1 line

From c70d9d809fdeecedb96972457ee45c49a232d97f Mon Sep 17 00:00:00 2001

From: "Eric W. Biederman" <[email protected]>
Date: Mon, 22 May 2017 15:40:12 -0500
Subject: [PATCH] ptrace: Properly initialize ptracer_cred on fork

When I introduced ptracer_cred I failed to consider the weirdness of fork where the task_struct copies the old value by default. This winds up leaving ptracer_cred set even when a process forks and the child process does not wind up being ptraced.

Because ptracer_cred is not set on non-ptraced processes whose parents were ptraced this has broken the ability of the enlightenment window manager to start setuid children.

Fix this by properly initializing ptracer_cred in ptrace_init_task

This must be done with a little bit of care to preserve the current value of ptracer_cred when ptrace carries through fork. Re-reading the ptracer_cred from the ptracing process at this point is inconsistent with how PT_PTRACE_CAP has been maintained all of these years.

Tested-by Takashi Iwai <[email protected]>
Fixes 64b875f7ac8a ("ptrace: Capture the ptracer's creds not PT_PTRACE_CAP")
Signed-off-by "Eric W. Biederman" <[email protected]>
---
 include/linux/ptrace.h |  7 +++++--
 kernel/ptrace.c        | 20 +++++++++++++-------
 2 files changed, 18 insertions(+), 9 deletions(-)
include/linux/ptrace.h +5 -2
index 422bc2e4cb6a..ef3eb8bbfee4 100644
@@ -54,7 +54,8 @@ extern int ptrace_request(struct task_struct *child, long request,
 			  unsigned long addr, unsigned long data);
 extern void ptrace_notify(int exit_code);
 extern void __ptrace_link(struct task_struct *child,
-			  struct task_struct *new_parent);
+			  struct task_struct *new_parent,
+			  const struct cred *ptracer_cred);
 extern void __ptrace_unlink(struct task_struct *child);
 extern void exit_ptrace(struct task_struct *tracer, struct list_head *dead);
 #define PTRACE_MODE_READ	0x01

@@ -206,7 +207,7 @@ static inline void ptrace_init_task(struct task_struct *child, bool ptrace)
 
 	if (unlikely(ptrace) && current->ptrace) {
 		child->ptrace = current->ptrace;
-		__ptrace_link(child, current->parent);
+		__ptrace_link(child, current->parent, current->ptracer_cred);
 
 		if (child->ptrace & PT_SEIZED)
 			task_set_jobctl_pending(child, JOBCTL_TRAP_STOP);

@@ -215,6 +216,8 @@ static inline void ptrace_init_task(struct task_struct *child, bool ptrace)
 
 		set_tsk_thread_flag(child, TIF_SIGPENDING);
 	}
+	else
+		child->ptracer_cred = NULL;
 }
 
 /**
kernel/ptrace.c +13 -7
index 266ddcc1d8bb..60f356d91060 100644
@@ -60,19 +60,25 @@ int ptrace_access_vm(struct task_struct *tsk, unsigned long addr,
 }
 
 
+void __ptrace_link(struct task_struct *child, struct task_struct *new_parent,
+		   const struct cred *ptracer_cred)
+{
+	BUG_ON(!list_empty(&child->ptrace_entry));
+	list_add(&child->ptrace_entry, &new_parent->ptraced);
+	child->parent = new_parent;
+	child->ptracer_cred = get_cred(ptracer_cred);
+}
+
 /*
  * ptrace a task: make the debugger its new parent and
  * move it to the ptrace list.
  *
  * Must be called with the tasklist lock write-held.
  */
-void __ptrace_link(struct task_struct *child, struct task_struct *new_parent)
+static void ptrace_link(struct task_struct *child, struct task_struct *new_parent)
 {
-	BUG_ON(!list_empty(&child->ptrace_entry));
-	list_add(&child->ptrace_entry, &new_parent->ptraced);
-	child->parent = new_parent;
 	rcu_read_lock();
-	child->ptracer_cred = get_cred(__task_cred(new_parent));
+	__ptrace_link(child, new_parent, __task_cred(new_parent));
 	rcu_read_unlock();
 }
 

@@ -386,7 +392,7 @@ static int ptrace_attach(struct task_struct *task, long request,
 		flags |= PT_SEIZED;
 	task->ptrace = flags;
 
-	__ptrace_link(task, current);
+	ptrace_link(task, current);
 
 	/* SEIZE doesn't trap tracee on attach */
 	if (!seize)

@@ -459,7 +465,7 @@ static int ptrace_traceme(void)
 		 */
 		if (!ret && !(current->real_parent->flags & PF_EXITING)) {
 			current->ptrace = PT_PTRACED;
-			__ptrace_link(current, current->real_parent);
+			ptrace_link(current, current->real_parent);
 		}
 	}
 	write_unlock_irq(&tasklist_lock);
Signature · 1 line
2.10.1
maintainer
#1 lore raw
Quoted 4 lines · Eric W. Biederman

Enlightenment is broken in 4.11 and possibly other kernels where commit 64b875f7ac8a ("ptrace: Capture the ptracer's creds not PT_PTRACE_CAP") is backported to.

Has no one noticed it being broken on 4.10? That's where that commit showed up, it seems odd we haven't had a bug report until now, right?

And the git commit id in that commit (4214e42f96d4), seems odd, where did it come from?

Quoted 2 lines

Can you please backport commit c70d9d809fde ("ptrace: Properly initialize ptracer_cred on fork") to the appropriate kernels.

I will queue it up for the next round after these are released.

thanks,

greg k-h