linux-kernel - [PATCH] NOMMU: Permit ptrace to ignore non-PROT

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <20060831202429.24083.96888.stgit@warthog.cambridge.redhat.com>
Date:	Thu, 31 Aug 2006 21:24:29 +0100
From:	David Howells <dhowells@...hat.com>
To:	torvalds@...l.org, akpm@...l.org
Cc:	linux-kernel@...r.kernel.org, uclinux-dev@...inux.org,
	dhowells@...hat.com
Subject: [PATCH] NOMMU: Permit ptrace to ignore non-PROT_WRITE VMAs in NOMMU mode

From: David Howells <dhowells@...hat.com>

Permit ptrace to modify a section that's non-shared but is marked unwritable,
such as is obtained by mapping the text segment of an ELF-FDPIC executable
binary with into a binary that's being ptraced[*].

[*] Under NOMMU conditions ptrace causes read-only MAP_PRIVATE mmaps to become
    totally private copies because if a private mapping was actually shared
    then the debugging setting breakpoints in it would potentially crash
    other processes.

This is done by using the VM_MAYWRITE flag rather than the VM_WRITE flag when
deciding whether to permit a write.

Without this patch a debugger can't set breakpoints in the mapped text sections
of executables that are mapped read-only private, even if the mmap() syscall
has taken a private copy because PT_PTRACED is set.

In addition, VM_MAYREAD is used instead of VM_READ for similar reasons.

Signed-Off-By: David Howells <dhowells@...hat.com>
---

 mm/nommu.c |    4 ++--
 1 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/mm/nommu.c b/mm/nommu.c
index 51e17b9..9d57c2a 100644
--- a/mm/nommu.c
+++ b/mm/nommu.c
@@ -1234,9 +1234,9 @@ int access_process_vm(struct task_struct
 			len = vma->vm_end - addr;
 
 		/* only read or write mappings where it is permitted */
-		if (write && vma->vm_flags & VM_WRITE)
+		if (write && vma->vm_flags & VM_MAYWRITE)
 			len -= copy_to_user((void *) addr, buf, len);
-		else if (!write && vma->vm_flags & VM_READ)
+		else if (!write && vma->vm_flags & VM_MAYREAD)
 			len -= copy_from_user(buf, (void *) addr, len);
 		else
 			len = 0;
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/