linux-kernel - Re: [patch V2 6/6] posix-cpu-timers: Return -EPERM if ptrace permission check fails

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20190923154611.GB11264@lenoir>
Date:   Mon, 23 Sep 2019 17:46:12 +0200
From:   Frederic Weisbecker <frederic@...nel.org>
To:     Thomas Gleixner <tglx@...utronix.de>
Cc:     LKML <linux-kernel@...r.kernel.org>,
        Frederic Weisbecker <fweisbec@...il.com>,
        Peter Zijlstra <peterz@...radead.org>,
        Ingo Molnar <mingo@...nel.org>,
        Oleg Nesterov <oleg@...hat.com>,
        Michael Kerrisk <mtk.manpages@...glemail.com>,
        Kees Cook <keescook@...omium.org>
Subject: Re: [patch V2 6/6] posix-cpu-timers: Return -EPERM if ptrace
 permission check fails

On Mon, Sep 23, 2019 at 04:54:41PM +0200, Thomas Gleixner wrote:
> Returning -EINVAL when a permission check fails is not really intuitive and
> can cause hard to diagnose problems.
> 
> The POSIX specification for clock_gettime() and timer_create() requires to
> obtain the clock id first by invoking clock_getcpuclockid().
> 
> clock_getcpuclockid() can return -EPERM if the caller does not have
> permissions. That does not make sense in two aspects:
> 
>  - Nothing prevents the caller to make up a clockid and feed it into the
>    syscalls
> 
>  - clock_getcpuclockid() is a helper function in glibc which just mangles
>    the PID/TID bits to the proper place and glibc cannot do any permission
>    checks at all for this function.
> 
> In order to prevent abuse the kernel has to do the permission checking in
> timer_create() and clock_gettime(). Those functions have only -EINVAL as
> documented return values, but returning -EINVAL for a valid clockid when
> the permission check fails is not understandable for programmers.
> 
> So ignore the POSIX specification and return -EPERM when the ptrace
> permission check fails.
> 
> Suggested-by: Peter Zijlstra <peterz@...radead.org>
> Signed-off-by: Thomas Gleixner <tglx@...utronix.de>

Reviewed-by: Frederic Weisbecker <frederic@...nel.org>