linux-kernel - [PATCH v4 2/3] exec: PR_HIDE_SELF_EXE hides /proc/self/map

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 10 Mar 2023 12:25:53 +0100
From:   Giuseppe Scrivano <gscrivan@...hat.com>
To:     linux-kernel@...r.kernel.org
Cc:     keescook@...omium.org, bristot@...hat.com, ebiederm@...ssion.com,
        brauner@...nel.org, cyphar@...har.com, viro@...iv.linux.org.uk,
        walters@...bum.org, avagin@...il.com, alexl@...hat.com,
        peterz@...radead.org, bmasney@...hat.com, gscrivan@...hat.com
Subject: [PATCH v4 2/3] exec: PR_HIDE_SELF_EXE hides /proc/self/map_files

extend the new prctl(PR_HIDE_SELF_EXE) to prevent using
/proc/self/map_files as well.

Signed-off-by: Giuseppe Scrivano <gscrivan@...hat.com>
---
 fs/proc/base.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/fs/proc/base.c b/fs/proc/base.c
index 14102a133655..72f1cb44691f 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -2255,9 +2255,21 @@ proc_map_files_get_link(struct dentry *dentry,
 			struct inode *inode,
 		        struct delayed_call *done)
 {
+	struct task_struct *task;
+	bool hide_self_exe;
+
 	if (!checkpoint_restore_ns_capable(&init_user_ns))
 		return ERR_PTR(-EPERM);
 
+	task = get_proc_task(d_inode(dentry));
+	if (!task)
+		return ERR_PTR(-ENOENT);
+	hide_self_exe = is_hide_self_exe_blocked(task);
+	put_task_struct(task);
+
+	if (hide_self_exe)
+		return ERR_PTR(-EPERM);
+
 	return proc_pid_get_link(dentry, inode, done);
 }
 
-- 
2.39.2