linux-kernel - Re: [RFC][PATCH v2] security: split proc ptrace checking into read vs. attach

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <1210880757.28282.157.camel@moss-spartans.epoch.ncsc.mil>
Date:	Thu, 15 May 2008 15:45:57 -0400
From:	Stephen Smalley <sds@...ho.nsa.gov>
To:	"Serge E. Hallyn" <serue@...ibm.com>
Cc:	lsm <linux-security-module@...r.kernel.org>,
	Chris Wright <chrisw@...s-sol.org>,
	James Morris <jmorris@...ei.org>,
	Eric Paris <eparis@...isplace.org>,
	Casey Schaufler <casey@...aufler-ca.com>,
	lkml <linux-kernel@...r.kernel.org>
Subject: Re: [RFC][PATCH v2] security:  split proc ptrace checking into
	read vs. attach

On Thu, 2008-05-15 at 14:37 -0500, Serge E. Hallyn wrote:
> Quoting Stephen Smalley (sds@...ho.nsa.gov):
<snip>
> > Read access to /proc/pid/mem continues to apply a full ptrace attach
> > check since check_mem_permission() already requires the current task
> > to already be ptracing the target.  The other ptrace checks within
> > proc for elements like environ, maps, and fds are changed to pass the
> > read mode instead of attach.
<snip>
> In this particular case, would it be worthwhile to also split
> check_mem_permission or pass it a mode bit?  Note that two of the
> three calls are for read permission only.

I was going to split up the mem checking, but when I noticed that
check_mem_permission() presently always requires current to already be
tracing the target process, I saw no point in distinguishing between the
different modes of access - they all effectively require full ptrace in
the first place.

The other case that might be nice to distinguish is readlink vs.
follow_link, as the latter potentially allows access to objects that
would otherwise be private to the target process (pipes, sockets) or
unreachable by current (files in directories not searchable by current),
as noted by Chris, but I'm not sure how helpful that will be in practice
because most if not all programs that access /proc/pid/fd at all end up
at least stat'ing the fd files even if they never open them, and thus
always hit follow_link.  But SELinux will check those attempts to stat
or open the files at least.

-- 
Stephen Smalley
National Security Agency

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/