linux-kernel - [PATCH] docs,procfs: document /proc/PID/* access permission checks

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250129001747.759990-1-andrii@kernel.org>
Date: Tue, 28 Jan 2025 16:17:47 -0800
From: Andrii Nakryiko <andrii@...nel.org>
To: linux-mm@...ck.org,
	akpm@...ux-foundation.org,
	linux-fsdevel@...r.kernel.org,
	brauner@...nel.org,
	viro@...iv.linux.org.uk
Cc: linux-kernel@...r.kernel.org,
	bpf@...r.kernel.org,
	kernel-team@...a.com,
	rostedt@...dmis.org,
	peterz@...radead.org,
	mingo@...nel.org,
	linux-trace-kernel@...r.kernel.org,
	linux-perf-users@...r.kernel.org,
	shakeel.butt@...ux.dev,
	rppt@...nel.org,
	liam.howlett@...cle.com,
	surenb@...gle.com,
	kees@...nel.org,
	jannh@...gle.com,
	Andrii Nakryiko <andrii@...nel.org>
Subject: [PATCH] docs,procfs: document /proc/PID/* access permission checks

Add a paragraph explaining what sort of capabilities a process would
need to read procfs data for some other process. Also mention that
reading data for its own process doesn't require any extra permissions.

Signed-off-by: Andrii Nakryiko <andrii@...nel.org>
---
 Documentation/filesystems/proc.rst | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/Documentation/filesystems/proc.rst b/Documentation/filesystems/proc.rst
index 09f0aed5a08b..0e7825bb1e3a 100644
--- a/Documentation/filesystems/proc.rst
+++ b/Documentation/filesystems/proc.rst
@@ -128,6 +128,16 @@ process running on the system, which is named after the process ID (PID).
 The link  'self'  points to  the process reading the file system. Each process
 subdirectory has the entries listed in Table 1-1.
 
+A process can read its own information from /proc/PID/* with no extra
+permissions. When reading /proc/PID/* information for other processes, reading
+process is required to have either CAP_SYS_PTRACE capability with
+PTRACE_MODE_READ access permissions, or, alternatively, CAP_PERFMON
+capability. This applies to all read-only information like `maps`, `environ`,
+`pagemap`, etc. The only exception is `mem` file due to its read-write nature,
+which requires CAP_SYS_PTRACE capabilities with more elevated
+PTRACE_MODE_ATTACH permissions; CAP_PERFMON capability does not grant access
+to /proc/PID/mem for other processes.
+
 Note that an open file descriptor to /proc/<pid> or to any of its
 contained files or subdirectories does not prevent <pid> being reused
 for some other process in the event that <pid> exits. Operations on
-- 
2.43.5