fix side effects of the kmod/ptrace secfix

PATCH In review Andreas Gietl 2 participants 5 messages Apr 24, 2003 – Apr 26, 2003

Share & tools

Andreas Gietl

author

2003-04-24 22:25 UTC #0 lore raw

Quoted 2 lines

You would need to restrict cmdline access to all root processes(not only suid) and maybe even to all processes with different capabilites and >

uid/gid

Quoted 2 lines

to work around problems in such processes. But you would break even more
system monitoring stuff this way(I've even heard shutdown is affected)

i can confirm that shutdown (halt|reboot) does not work on my 2.4.21-rc1-ac1 boxes. (gentoo + redhat).

But your patch does not seem to fix it.

Signature · 6 lines

e-admin internet gmbh
Andreas Gietl                                            tel +49 941 3810884
Ludwig-Thoma-Strasse 35                      fax +49 89 244329104
93051 Regensburg                                  mobil +49 171 6070008

PGP/GPG-Key unter http://www.e-admin.de/gpg.html

Bernhard Kaindl

2003-04-25 11:25 UTC #1 lore raw

PATCH 1/1 fix side effects of the kmod/ptrace secfix

Quoted 4 lines · Andreas Gietl

Quoted 1 line
system monitoring stuff this way(I've even heard shutdown is affected)
i can confirm that shutdown (halt|reboot) does not work on my 2.4.21-rc1-ac1 boxes. (gentoo + redhat).

Thanks for the info!

Quoted 1 line

But your patch does not seem to fix it.

Very interesting also, the two liner adressed only the well-known problems. To fix the other not so well-known side effects, a real cleanup is the way to go.

Can you try the attached cleanup patch instead of the two-liner?

It's an inital cleanup and should fix the other side effects which I described in my mails.

Bernhard Kaindl

PS: If either patch is applied correctly, this

su guest -c 'ps $PPID;wc -m </proc/$PPID/cmdline'

should give:

  PID TTY      STAT   TIME COMMAND
 2452 pts/2    S      0:00 su bin -c ps $PPID;wc -m </proc/$PPID/cmdline
     46

If it does not, access_process_vm is not fixed properly.

Second, calling this as root:

strace -fewrite su -c /bin/echo 2>&1 | grep pid

should give:

[pid 2599] --- SIGSTOP (Stopped (signal)) @ 0 (0) --- [pid 2599] write(1, "\n", 1

If it does not, ptrace_check_attach is not fixed properly.

(These are only the checks for the well known side effects which should be fixed even with the short is_dumpable() -> task_dumpable patch.)

ptrace.c +0 -5

@@ -21,9 +21,6 @@
  */
 int ptrace_check_attach(struct task_struct *child, int kill)
 {
-	mb();
-	if (!is_dumpable(child))
-		return -EPERM;
 
 	if (!(child->ptrace & PT_PTRACED))
 		return -ESRCH;

@@ -127,8 +124,6 @@ int access_process_vm(struct task_struct
 	/* Worry about races with exit() */
 	task_lock(tsk);
 	mm = tsk->mm;
-	if (!is_dumpable(tsk) || (&init_mm == mm))
-		mm = NULL;
 	if (mm)
 		atomic_inc(&mm->mm_users);
 	task_unlock(tsk);

sys.c +1 -2

@@ -1252,8 +1252,7 @@ asmlinkage long sys_prctl(int option, un
 				error = -EINVAL;
 				break;
 			}
-			if (is_dumpable(current))
-				current->mm->dumpable = arg2;
+			current->mm->dumpable = arg2;
 			break;
 
 	        case PR_SET_UNALIGN:

Andreas Gietl

author

2003-04-25 14:28 UTC #2 lore raw

Quoted 23 lines · Bernhard Kaindl

Quoted 4 lines · Andreas Gietl
Quoted 1 line
system monitoring stuff this way(I've even heard shutdown is affected)
i can confirm that shutdown (halt|reboot) does not work on my 2.4.21-rc1-ac1 boxes. (gentoo + redhat).
Thanks for the info!
Quoted 1 line
But your patch does not seem to fix it.
Very interesting also, the two liner adressed only the well-known problems. To fix the other not so well-known side effects, a real cleanup is the way to go.
Can you try the attached cleanup patch instead of the two-liner?
It's an inital cleanup and should fix the other side effects which I described in my mails.
Bernhard Kaindl
PS: If either patch is applied correctly, this

Quoted 7 lines

su guest -c 'ps $PPID;wc -m </proc/$PPID/cmdline'
should give:
  PID TTY      STAT   TIME COMMAND
 2452 pts/2    S      0:00 su bin -c ps $PPID;wc -m </proc/$PPID/cmdline
     46

it shows:

  PID TTY      STAT   TIME COMMAND
 2092 ttyp0    S      0:00 su guest -c ps $PPID;wc -m </proc/$PPID/cmdline
      0

but cat shows:
su guest -c 'ps $PPID; cat /proc/$PPID/cmdline'

  PID TTY      STAT   TIME COMMAND
 2144 ttyp0    S      0:00 su guest -c ps $PPID; cat /proc/$PPID/cmdline

suguest-cps $PPID; cat /proc/$PPID/cmdline

what happened?

Quoted 11 lines

If it does not, access_process_vm is not fixed properly.
Second, calling this as root:
strace -fewrite su -c /bin/echo 2>&1 | grep pid
should give:
[pid 2599] --- SIGSTOP (Stopped (signal)) @ 0 (0) --- [pid 2599] write(1, "\n", 1

it shows:
localhost root # strace -fewrite su -c /bin/echo 2>&1 | grep pid [pid 2159] write(1, "\n", 1

Quoted 6 lines

If it does not, ptrace_check_attach is not fixed properly.
(These are only the checks for the well known side effects which should be fixed even with the short is_dumpable() -> task_dumpable patch.)

Looks like my results are slightly diffent, Does this mean i did not apply the patch correctly? I applied it twice manually, because patch did not succeed and compiled the kernel 3 times...

Signature · 6 lines

e-admin internet gmbh
Andreas Gietl                                            tel +49 941 3810884
Ludwig-Thoma-Strasse 35                      fax +49 89 244329104
93051 Regensburg                                  mobil +49 171 6070008

PGP/GPG-Key unter http://www.e-admin.de/gpg.html

Bernhard Kaindl

2003-04-25 16:32 UTC #3 lore raw

Quoted 5 lines · Andreas Gietl

it shows:

  PID TTY      STAT   TIME COMMAND
 2092 ttyp0    S      0:00 su guest -c ps $PPID;wc -m </proc/$PPID/cmdline
      0

Ah ok, I tested this with LC_CTYPE=de_DE.UTF-8, in this case wc has to read the contents of the file. When a single-byte locale is used, wc just does fstat64() to get the file size(which returns 0 for the file).

Quoted 7 lines

but cat shows:
su guest -c 'ps $PPID; cat /proc/$PPID/cmdline'
  PID TTY      STAT   TIME COMMAND
 2144 ttyp0    S      0:00 su guest -c ps $PPID; cat /proc/$PPID/cmdline
suguest-cps $PPID; cat /proc/$PPID/cmdline
what happened?

This is ok, access_proces_vm() is working.

Quoted 6 lines

Quoted 2 lines
[pid 2599] --- SIGSTOP (Stopped (signal)) @ 0 (0) --- [pid 2599] write(1, "\n", 1
it shows:
localhost root # strace -fewrite su -c /bin/echo 2>&1 | grep pid [pid 2159] write(1, "\n", 1

Looks ok also, the task->mm->dumpable check is removed from prace_check_attach

Quoted 2 lines

Looks like my results are slightly diffent, Does this mean i did not apply the patch correctly? I applied it twice manually, because patch did not succeed

The above shows that at least the two-liner task_dumpable diff is applied.

Quoted 1 line

and compiled the kernel 3 times...

Sorry for the different output, I should have made my tests safer against system variants. It should have applied clean, maybe some white space issue or so, I'll check it. shutdown didn't change? What does it on your system?

Bernd

Andreas Gietl

author

2003-04-26 16:46 UTC #4 lore raw

On Friday 25 April 2003 16:30, Bernhard Kaindl wrote:

looks like the shutdown problem was not due to a ptrace-problem, but to a IDE-Bug in the ac1-patch:

Hi!

Here is a first test report for 2.4.21-rc1-ac2:

*) Shutdown/Reboot problems in 2.4.21-rc1-ac1 due to
deadlock in ide_unregister_subdriver() seem to be fixed!

rc1-ac2 fixed my shutdown problem.

thanx for the support

Quoted 48 lines · Andreas Gietl

Quoted 4 lines
it shows:
  PID TTY      STAT   TIME COMMAND
 2092 ttyp0    S      0:00 su guest -c ps $PPID;wc -m
</proc/$PPID/cmdline 0
Ah ok, I tested this with LC_CTYPE=de_DE.UTF-8, in this case wc has to read the contents of the file. When a single-byte locale is used, wc just does fstat64() to get the file size(which returns 0 for the file).
Quoted 7 lines
but cat shows:
su guest -c 'ps $PPID; cat /proc/$PPID/cmdline'
  PID TTY      STAT   TIME COMMAND
 2144 ttyp0    S      0:00 su guest -c ps $PPID; cat /proc/$PPID/cmdline
suguest-cps $PPID; cat /proc/$PPID/cmdline
what happened?
This is ok, access_proces_vm() is working.
Quoted 6 lines
Quoted 2 lines
[pid 2599] --- SIGSTOP (Stopped (signal)) @ 0 (0) --- [pid 2599] write(1, "\n", 1
it shows:
localhost root # strace -fewrite su -c /bin/echo 2>&1 | grep pid [pid 2159] write(1, "\n", 1
Looks ok also, the task->mm->dumpable check is removed from prace_check_attach
Quoted 3 lines
Looks like my results are slightly diffent, Does this mean i did not apply the patch correctly? I applied it twice manually, because patch did not succeed
The above shows that at least the two-liner task_dumpable diff is applied.
Quoted 1 line
and compiled the kernel 3 times...
Sorry for the different output, I should have made my tests safer against system variants. It should have applied clean, maybe some white space issue or so, I'll check it. shutdown didn't change? What does it on your system?
Bernd
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

Signature · 6 lines

e-admin internet gmbh
Andreas Gietl                                            tel +49 941 3810884
Ludwig-Thoma-Strasse 35                      fax +49 89 244329104
93051 Regensburg                                  mobil +49 171 6070008

PGP/GPG-Key unter http://www.e-admin.de/gpg.html