How to fix the ptrace flaw without rebooting

DISCUSSION Chuck Ebbert 4 participants 4 messages Apr 4, 2003 – Apr 6, 2003

Share & tools

Alan Cox

2003-04-04 12:18 UTC #1 lore raw

Quoted 11 lines · Chuck Ebbert

Quoted 2 lines · Erik Hensema
A better fix in a running system is to simply disable dynamic module
loading: echo /no/such/file > /proc/sys/kernel/modprobe
You mean like this?
   # echo 'x'>/proc/sys/kernel/modprobe
   bash: /proc/sys/kernel/modprobe: No such file or directory

Thats not a sufficient fix except for people blindly running the example exploit

Henning P. Schmiedehausen

2003-04-05 08:23 UTC #2 lore raw

[2.4] ptrace bugfix breaks strace and keeps processes in STOPPED state (was: Re: How to fix the ptrace flaw without rebooting)

Quoted 8 lines · Alan Cox

Quoted 7 lines · Chuck Ebbert
Quoted 2 lines · Erik Hensema
A better fix in a running system is to simply disable dynamic module
loading: echo /no/such/file > /proc/sys/kernel/modprobe

Quoted 7 lines

Quoted 4 lines
You mean like this?
   # echo 'x'>/proc/sys/kernel/modprobe
   bash: /proc/sys/kernel/modprobe: No such file or directory
Thats not a sufficient fix except for people blindly running the example exploit

Speaking of the exploit fix: Since I run a kernel which has it installed, I can no longer strace processes which do run as root but have a gid sbit set, e.g.

# ls -la /tmp/bash 
-rwxr-sr-x    1 root     smmsp      541096 Apr  5 10:21 /tmp/bash
# id
uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel)
# /tmp/bash
bash-2.05a# echo $$
2625

(in another shell)

# strace -f -p 2625
trace: ptrace(PTRACE_SYSCALL, ...): Operation not permitted
detach: ptrace(PTRACE_DETACH, ...): Operation not permitted

but the shell with the pid of 2625 is now "dead" until one sends it a SIGCONT:

# kill -CONT 2625

(other shell now works again)

% uname -an
Linux henning-pc 2.4.18-27.7.x #1 Fri Mar 14 06:44:53 EST 2003 i686 unknown

I'm running the most current strace (4.4.94) because of the STOP/CONT problems before (RH bugzilla #64303, #75709) but this is new after installing the exploit fix.

(I found this BTW trying to trace sendmail that's why I have that test case with setgid to smmsp).

Regards
Henning

Signature · 5 lines

Dipl.-Inf. (Univ.) Henning P. Schmiedehausen          INTERMETA GmbH
[email protected]        +49 9131 50 654 0   http://www.intermeta.de/

Java, perl, Solaris, Linux, xSP Consulting, Web Services 
freelance consultant -- Jakarta Turbine Development  -- hero for hire

Paul Jakma

2003-04-06 01:16 UTC #3 lore raw

In reply to Alan Cox

Quoted 2 lines · Alan Cox

Thats not a sufficient fix except for people blindly running the example exploit

Also, removing CAP_SYS_PTRACE from the capability bounded set does not close the hole (well, as shown by the exploit) either. It seems CAP_SYS_PTRACE only closes the case of PTRACE_ATTACH, all other ptrace()'s work, eg PTRACE_TRACEME -> strace echo foo and the exploit works too.

Should CAP_SYS_PTRACE not do as the name suggests and completely disallow ptrace()? (not just PTRACE_ATTACH).

regards,

Signature · 6 lines

Paul Jakma	[email protected]	[email protected]	Key ID: 64A2FF6A
	warning: do not ever send email to [email protected]
Fortune:
An egghead is one who stands firmly on both feet, in mid-air, on both
sides of an issue.
		-- Homer Ferguson