Files
android_kernel_xiaomi_sm8450/include/linux
Eric W. Biederman bfedb58925 mm: Add a user_ns owner to mm_struct and fix ptrace permission checks
During exec dumpable is cleared if the file that is being executed is
not readable by the user executing the file.  A bug in
ptrace_may_access allows reading the file if the executable happens to
enter into a subordinate user namespace (aka clone(CLONE_NEWUSER),
unshare(CLONE_NEWUSER), or setns(fd, CLONE_NEWUSER).

This problem is fixed with only necessary userspace breakage by adding
a user namespace owner to mm_struct, captured at the time of exec, so
it is clear in which user namespace CAP_SYS_PTRACE must be present in
to be able to safely give read permission to the executable.

The function ptrace_may_access is modified to verify that the ptracer
has CAP_SYS_ADMIN in task->mm->user_ns instead of task->cred->user_ns.
This ensures that if the task changes it's cred into a subordinate
user namespace it does not become ptraceable.

The function ptrace_attach is modified to only set PT_PTRACE_CAP when
CAP_SYS_PTRACE is held over task->mm->user_ns.  The intent of
PT_PTRACE_CAP is to be a flag to note that whatever permission changes
the task might go through the tracer has sufficient permissions for
it not to be an issue.  task->cred->user_ns is always the same
as or descendent of mm->user_ns.  Which guarantees that having
CAP_SYS_PTRACE over mm->user_ns is the worst case for the tasks
credentials.

To prevent regressions mm->dumpable and mm->user_ns are not considered
when a task has no mm.  As simply failing ptrace_may_attach causes
regressions in privileged applications attempting to read things
such as /proc/<pid>/stat

Cc: stable@vger.kernel.org
Acked-by: Kees Cook <keescook@chromium.org>
Tested-by: Cyrill Gorcunov <gorcunov@openvz.org>
Fixes: 8409cca705 ("userns: allow ptrace from non-init user namespaces")
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
2016-11-22 11:49:48 -06:00
..
2016-07-08 16:23:11 +02:00
2016-11-11 23:23:02 +01:00
2016-08-25 11:26:48 -04:00
2016-09-14 09:18:06 -06:00
2016-06-07 13:41:38 -06:00
2016-09-29 01:35:35 -04:00
2016-08-11 09:41:35 -06:00
2016-09-27 21:20:53 -04:00
2016-08-02 19:35:24 -04:00
2016-10-07 18:46:30 -07:00
2016-09-16 09:34:15 +01:00
2016-06-07 13:41:38 -06:00
2016-05-17 15:48:12 -04:00
2016-10-30 13:09:42 -04:00
2016-09-16 12:44:20 +02:00
2016-07-22 09:07:02 +02:00
2016-09-24 10:48:18 +02:00
2016-10-20 15:51:28 +11:00
2016-09-16 09:34:15 +01:00
2016-09-14 09:18:09 -06:00
2016-09-20 23:20:32 +02:00
2016-05-11 22:37:54 +02:00
2016-08-10 11:23:44 -04:00
2016-09-15 16:49:39 +02:00
2016-09-14 12:57:43 -07:00
2016-09-27 12:33:47 +02:00
2016-10-24 19:13:20 -07:00
2016-08-04 10:16:55 +09:30
2016-07-29 12:17:52 -07:00
2016-08-28 23:32:41 -04:00
2016-06-03 19:37:21 -04:00
2016-04-25 15:09:11 -04:00
2016-10-19 11:36:22 -06:00
2016-05-02 09:00:56 -05:00
2016-10-14 11:36:59 -07:00
2016-07-12 19:25:38 -07:00
2016-09-27 21:52:00 -04:00
2016-09-08 15:01:10 -07:00
2016-09-08 15:01:10 -07:00
2016-07-06 10:51:14 +01:00
2016-09-20 04:43:36 -04:00
2016-07-26 16:19:19 -07:00
2016-09-08 22:15:25 -07:00
2016-06-14 10:54:40 -07:00
2016-09-06 18:30:20 +02:00
2016-08-28 23:44:55 -04:00
2016-05-08 23:46:14 -04:00
2016-10-05 18:23:36 -04:00
2016-10-07 18:46:27 -07:00
2016-09-21 00:23:00 -04:00
2016-06-20 12:47:15 -07:00
2016-07-19 17:43:38 +03:00
2016-05-23 17:04:14 -07:00
2016-07-26 16:19:19 -07:00
2016-05-20 17:58:30 -07:00
2016-06-25 09:04:48 -07:00
2016-09-30 10:54:03 +02:00
2016-08-29 08:13:21 -06:00