Commit 31e62c2e authored by Linus Torvalds's avatar Linus Torvalds
Browse files

ptrace: slightly saner 'get_dumpable()' logic 



The 'dumpability' of a task is fundamentally about the memory image of
the task - the concept comes from whether it can core dump or not - and
makes no sense when you don't have an associated mm.

And almost all users do in fact use it only for the case where the task
has a mm pointer.

But we have one odd special case: ptrace_may_access() uses 'dumpable' to
check various other things entirely independently of the MM (typically
explicitly using flags like PTRACE_MODE_READ_FSCREDS).  Including for
threads that no longer have a VM (and maybe never did, like most kernel
threads).

It's not what this flag was designed for, but it is what it is.

The ptrace code does check that the uid/gid matches, so you do have to
be uid-0 to see kernel thread details, but this means that the
traditional "drop capabilities" model doesn't make any difference for
this all.

Make it all make a *bit* more sense by saying that if you don't have a
MM pointer, we'll use a cached "last dumpability" flag if the thread
ever had a MM (it will be zero for kernel threads since it is never
set), and require a proper CAP_SYS_PTRACE capability to override.

Reported-by: default avatarQualys Security Advisory <qsa@qualys.com>
Cc: Oleg Nesterov <oleg@redhat.com>
Cc: Kees Cook <kees@kernel.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent 59a62ea4

include/linux/sched.h

+3 −0
Original line number Diff line number Diff line
@@ -1002,6 +1002,9 @@ struct task_struct { 
	unsigned			sched_rt_mutex:1;

#endif



	/* Save user-dumpable when mm goes away */

	unsigned			user_dumpable:1;



	/* Bit to tell TOMOYO we're in execve(): */

	unsigned			in_execve:1;

	unsigned			in_iowait:1;

kernel/exit.c

+1 −0
Original line number Diff line number Diff line
@@ -571,6 +571,7 @@ static void exit_mm(void) 
	 */

	smp_mb__after_spinlock();

	local_irq_disable();

	current->user_dumpable = (get_dumpable(mm) == SUID_DUMP_USER);

	current->mm = NULL;

	membarrier_update_current_mm(NULL);

	enter_lazy_tlb(mm, current);

kernel/ptrace.c

+16 −6
Original line number Diff line number Diff line
@@ -272,11 +272,24 @@ static bool ptrace_has_cap(struct user_namespace *ns, unsigned int mode) 
	return ns_capable(ns, CAP_SYS_PTRACE);

}



static bool task_still_dumpable(struct task_struct *task, unsigned int mode)

{

	struct mm_struct *mm = task->mm;

	if (mm) {

		if (get_dumpable(mm) == SUID_DUMP_USER)

			return true;

		return ptrace_has_cap(mm->user_ns, mode);

	}



	if (task->user_dumpable)

		return true;

	return ptrace_has_cap(&init_user_ns, mode);

}



/* Returns 0 on success, -errno on denial. */

static int __ptrace_may_access(struct task_struct *task, unsigned int mode)

{

	const struct cred *cred = current_cred(), *tcred;

	struct mm_struct *mm;

	kuid_t caller_uid;

	kgid_t caller_gid;
@@ -337,10 +350,7 @@ static int __ptrace_may_access(struct task_struct *task, unsigned int mode) 
	 * Pairs with a write barrier in commit_creds().

	 */

	smp_rmb();

	mm = task->mm;

	if (mm &&

	    ((get_dumpable(mm) != SUID_DUMP_USER) &&

	     !ptrace_has_cap(mm->user_ns, mode)))

	if (!task_still_dumpable(task, mode))

		return -EPERM;



	return security_ptrace_access_check(task, mode);