linux-kernel - Re: [PATCH 01/26] ptrace: export ptrace_may

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <173399496234.20348.12425394481969055234@jlahtine-mobl.ger.corp.intel.com>
Date: Thu, 12 Dec 2024 11:16:02 +0200
From: Joonas Lahtinen <joonas.lahtinen@...ux.intel.com>
To: Christoph Hellwig <hch@...radead.org>, Mika Kuoppala <mika.kuoppala@...ux.intel.com>
Cc: intel-xe@...ts.freedesktop.org, dri-devel@...ts.freedesktop.org, christian.koenig@....com, Oleg Nesterov <oleg@...hat.com>, linux-kernel@...r.kernel.org, Dave Airlie <airlied@...hat.com>, Lucas De Marchi <lucas.demarchi@...el.com>, Matthew Brost <matthew.brost@...el.com>, Andi Shyti <andi.shyti@...el.com>, Maciej Patelczyk <maciej.patelczyk@...ux.intel.com>, Dominik Grzegorzek <dominik.grzegorzek@...el.com>, Jonathan Cavitt <jonathan.cavitt@...el.com>, Andi Shyti <andi.shyti@...ux.intel.com>
Subject: Re: [PATCH 01/26] ptrace: export ptrace_may_access

Quoting Christoph Hellwig (2024-12-10 06:29:38)
> On Mon, Dec 09, 2024 at 03:32:52PM +0200, Mika Kuoppala wrote:
> > xe driver would like to allow fine grained access control
> > for GDB debugger using ptrace. Without this export, the only
> > option would be to check for CAP_SYS_ADMIN.
> > 
> > The check intended for an ioctl to attach a GPU debugger
> > is similar to the ptrace use case: allow a calling process
> > to manipulate a target process if it has the necessary
> > capabilities or the same permissions, as described in
> > Documentation/process/adding-syscalls.rst.
> > 
> > Export ptrace_may_access function to allow GPU debugger to
> > have identical access control for debugger(s)
> > as a CPU debugger.
> 
> This seems to mis an actual user or you forgot to Cc linux-kernel on it.

Right, that is a miss on our side. For the time being, the whole series
can be found in lore archive:

https://lore.kernel.org/dri-devel/20241209133318.1806472-1-mika.kuoppala@linux.intel.com/

The user is introduced in patch: [PATCH 03/26] drm/xe/eudebug: Introduce discovery for resources [1]

Essentially, we want to check if PID1 has permission to ptrace PID2, before we grant the
permission for PID1 to debug the GPU address space/memory of PID2.

Mika, please do Cc the relevant other patches of the series to LKML for next iteration.

Regards, Joonas

[1] https://lore.kernel.org/dri-devel/20241209133318.1806472-1-mika.kuoppala@linux.intel.com/T/#md3d005faaaac1ba01451b139a634e5545c2a266f