Eric W. Biederman
694a95fa6d
mm: Add a user_ns owner to mm_struct and fix ptrace permission checks ...
commit bfedb589252c01fa505ac9f6f2a3d5d68d707ef4 upstream.
During exec dumpable is cleared if the file that is being executed is
not readable by the user executing the file. A bug in
ptrace_may_access allows reading the file if the executable happens to
enter into a subordinate user namespace (aka clone(CLONE_NEWUSER),
unshare(CLONE_NEWUSER), or setns(fd, CLONE_NEWUSER).
This problem is fixed with only necessary userspace breakage by adding
a user namespace owner to mm_struct, captured at the time of exec, so
it is clear in which user namespace CAP_SYS_PTRACE must be present in
to be able to safely give read permission to the executable.
The function ptrace_may_access is modified to verify that the ptracer
has CAP_SYS_ADMIN in task->mm->user_ns instead of task->cred->user_ns.
This ensures that if the task changes it's cred into a subordinate
user namespace it does not become ptraceable.
The function ptrace_attach is modified to only set PT_PTRACE_CAP when
CAP_SYS_PTRACE is held over task->mm->user_ns. The intent of
PT_PTRACE_CAP is to be a flag to note that whatever permission changes
the task might go through the tracer has sufficient permissions for
it not to be an issue. task->cred->user_ns is always the same
as or descendent of mm->user_ns. Which guarantees that having
CAP_SYS_PTRACE over mm->user_ns is the worst case for the tasks
credentials.
To prevent regressions mm->dumpable and mm->user_ns are not considered
when a task has no mm. As simply failing ptrace_may_attach causes
regressions in privileged applications attempting to read things
such as /proc/<pid>/stat
Acked-by: Kees Cook <keescook@chromium.org>
Tested-by: Cyrill Gorcunov <gorcunov@openvz.org>
Fixes: 8409cca705
2017-01-06 10:40:13 +01:00
bpf: fix states equal logic for varlen access
2016-11-30 14:50:52 -05:00
config: android: enable CONFIG_SECCOMP
2016-10-11 15:06:32 -07:00
perf/core: Remove invalid warning from list_update_cgroup_even()t
2016-12-06 09:44:29 +01:00
gcov: add support for gcc version >= 6
2016-07-15 14:54:27 +09:00
genirq: Use irq type from irqdata instead of irqdesc
2016-11-08 15:15:19 +01:00
livepatch/module: make TAINT_LIVEPATCH module-specific
2016-08-26 14:42:08 +02:00
lockdep: Fix report formatting
2016-12-06 10:40:08 +01:00
PM / sleep: fix device reference leak in test_suspend
2016-11-02 05:10:04 +01:00
Revert "printk: make reading the kernel log flush pending lines"
2016-11-14 09:31:52 -08:00
This adds a new gcc plugin named "latent_entropy". It is designed to
2016-10-15 10:03:15 -07:00
sched/autogroup: Fix 64-bit kernel nice level adjustment
2016-11-24 05:45:02 +01:00
timers: Prevent base clock corruption when forwarding
2016-10-25 16:32:50 +02:00
ftrace: Add more checks for FTRACE_FL_DISABLED in processing ip records
2016-11-14 16:31:49 -05:00
Merge branch 'stable-4.9' of git://git.infradead.org/users/pcmoore/audit
2016-10-04 14:21:41 -07:00
Merge branch 'stable-4.8' of git://git.infradead.org/users/pcmoore/audit
2016-07-29 17:54:17 -07:00
audit: cleanup prune_tree_thread
2016-04-04 09:46:47 -04:00
Merge branch 'stable-4.8' of git://git.infradead.org/users/pcmoore/audit
2016-09-01 15:55:56 -07:00
audit: add fields to exclude filter by reusing user filter
2016-06-27 11:01:00 -04:00
Merge branch 'stable-4.9' of git://git.infradead.org/users/pcmoore/audit
2016-10-04 14:21:41 -07:00
exec: Ensure mm->user_ns contains the execed files
2017-01-06 10:40:12 +01:00
Merge branch 'for-4.9' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup
2016-10-14 12:18:50 -07:00
cgroup: Use lld instead of ld when printing pids controller events_limit
2016-06-21 15:03:36 -04:00
hotplug: Make register and unregister notifier API symmetric
2017-01-06 10:40:10 +01:00
Merge branch 'for-4.9' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup
2016-10-14 12:18:50 -07:00
cred: Reject inodes with invalid ids in set_create_file_as()
2016-06-30 18:05:09 -05:00
sched/autogroup: Do not use autogroup->tg in zombie threads
2016-11-22 12:33:43 +01:00
mm: Add a user_ns owner to mm_struct and fix ptrace permission checks
2017-01-06 10:40:13 +01:00
freezer, oom: check TIF_MEMDIE on the correct task
2016-07-28 16:07:41 -07:00
futex: Add some more function commentry
2016-09-05 17:20:18 +02:00
cred: simpler, 1D supplementary groups
2016-10-07 18:46:30 -07:00
hung_task: allow hung_task_panic when hung_task_warnings is 0
2016-10-11 15:06:33 -07:00
powerpc updates for 4.8 #2
2016-08-05 09:00:54 -04:00
kallsyms: add support for relative offsets in kallsyms address table
2016-03-15 16:55:16 -07:00
kcov: add missing #include <linux/sched.h>
2016-12-07 17:10:00 -08:00
kexec: allow architectures to override boot mapping
2016-08-02 19:35:27 -04:00
kexec: add restriction on kexec_load() segment sizes
2016-08-02 19:35:31 -04:00
kexec: fix double-free when failing to relocate the purgatory
2016-09-01 17:52:01 -07:00
kprobes: include <asm/sections.h> instead of <asm-generic/sections.h>
2016-10-11 15:06:31 -07:00
kexec: add a kexec_crash_loaded() function
2016-08-02 19:35:30 -04:00
kthread: better support freezable kthread workers
2016-10-11 15:06:33 -07:00
userns: Add per user namespace sysctls.
2016-08-08 13:18:58 -05:00
mm: fix cache mode of dax pmd mappings
2016-09-09 17:34:46 -07:00
Re-enable CONFIG_MODVERSIONS in a slightly weaker form
2016-11-29 16:01:30 -08:00
KEYS: Move the point of trust determination to __key_link()
2016-04-11 22:43:43 +01:00
padata: Convert to hotplug state machine
2016-09-19 21:44:30 +02:00
x86/panic: replace smp_send_stop() with kdump friendly version in panic path
2016-10-11 15:06:32 -07:00
remove lots of IS_ERR_VALUE abuses
2016-05-27 15:26:11 -07:00
Merge branch 'nsfs-ioctls' into HEAD
2016-09-22 20:00:36 -05:00
profile: Convert to hotplug state machine
2016-07-15 10:41:42 +02:00
mm: Add a user_ns owner to mm_struct and fix ptrace permission checks
2017-01-06 10:40:13 +01:00
relay: Use irq_work instead of plain timer for deferred wakeup
2016-10-11 15:06:32 -07:00
/proc/iomem: only expose physical resource addresses to privileged users
2016-04-14 12:56:09 -07:00
seccomp: Fix tracer exit notifications during fatal signals
2016-08-30 16:12:46 -07:00
x86/signal: Add SA_{X32,IA32}_ABI sa_flags
2016-09-14 21:28:11 +02:00
smp: Allocate smp_call_on_cpu() workqueue on stack too
2016-09-22 14:49:10 +02:00
kthread/smpboot: do not park in kthread_create_on_cpu()
2016-10-11 15:06:33 -07:00
cpu/hotplug: Create hotplug threads
2016-03-01 20:36:56 +01:00
softirq: Display IRQ_POLL for irq-poll statistics
2016-10-21 15:45:47 -06:00
Merge branch 'sched-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2016-10-03 13:39:00 -07:00
prctl: make PR_SET_THP_DISABLE wait for mmap_sem killable
2016-05-23 17:04:14 -07:00
x86/pkeys: Fix pkeys build breakage for some non-x86 arches
2016-09-13 14:41:36 +02:00
Merge branch 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2016-10-10 13:04:49 -07:00
kernel/sysctl_binary.c: use generic UUID library
2016-05-20 17:58:30 -07:00
task_work: use READ_ONCE/lockless_dereference, avoid pi_lock if !task_works
2016-08-02 19:35:02 -04:00
taskstats: fix the length of cgroupstats_cmd_get_policy
2016-11-03 16:55:58 -04:00
torture: Convert torture_shutdown() to hrtimer
2016-08-22 10:01:49 -07:00
kernel/...: convert pr_warning to pr_warn
2016-03-22 15:36:02 -07:00
time, acct: Drop irq save & restore from __acct_update_integrals()
2016-02-29 09:53:09 +01:00
mntns: Add a limit on the number of mount namespaces.
2016-08-31 07:28:35 -05:00
cred: simpler, 1D supplementary groups
2016-10-07 18:46:30 -07:00
smp: Add function to execute a function synchronously on a CPU
2016-09-05 13:52:39 +02:00
Merge branch 'nsfs-ioctls' into HEAD
2016-09-22 20:00:36 -05:00
Merge branch 'nsfs-ioctls' into HEAD
2016-09-22 20:00:36 -05:00
Revert "perf/x86/intel, watchdog: Switch NMI watchdog to ref cycles on x86"
2016-07-10 20:58:36 +02:00
kthread: rename probe_kthread_data() to kthread_probe_data()
2016-10-11 15:06:33 -07:00
sched/core: Get rid of 'cpu' argument in wq_worker_sleeping()
2016-03-02 10:28:47 -05:00
694a95fa6d