linux-kernel - Re: [PATCH] fs: hidepid: Fixes hidepid non dumpable behavior

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <11c531fb-7c51-423f-bf75-ffa13b2039f1@oss.cyber.gouv.fr>
Date: Fri, 18 Jul 2025 10:59:39 +0200
From: Nicolas Bouchinet <nicolas.bouchinet@....cyber.gouv.fr>
To: linux-fsdevel@...r.kernel.org
Cc: linux-kernel@...r.kernel.org,
 Olivier Bal-Petre <olivier.bal-petre@....cyber.gouv.fr>,
 Nicolas Bouchinet <nicolas.bouchinet@....gouv.fr>
Subject: Re: [PATCH] fs: hidepid: Fixes hidepid non dumpable behavior

Note that a yama patch has also been sent [1].

[1]: 
https://lore.kernel.org/all/20250718-yama_fix-v1-1-a51455359e67@ssi.gouv.fr/

Best regards,

Nicolas

On 7/18/25 10:47, nicolas.bouchinet@....cyber.gouv.fr wrote:
> From: Nicolas Bouchinet <nicolas.bouchinet@....gouv.fr>
>
> The hidepid mount option documentation defines the following modes:
>
> - "noaccess": user may not access any `/proc/<pid>/ directories but
>    their own.
> - "invisible": all `/proc/<pid>/` will be fully invisible to other users.
> - "ptraceable": means that procfs should only contain `/proc/<pid>/`
>    directories that the caller can ptrace.
>
> We thus expect that with "noaccess" and "invisible" users would be able to
> see their own processes in `/proc/<pid>/`.
>
> The implementation of hidepid however control accesses using the
> `ptrace_may_access()` function in any cases. Thus, if a process set
> itself as non-dumpable using the `prctl(PR_SET_DUMPABLE,
> SUID_DUMP_DISABLE)` it becomes invisible to the user.
>
> This patch fixes the `has_pid_permissions()` function in order to make
> its behavior to match the documentation.
>
> Note that since `ptrace_may_access()` is not called anymore with
> "noaccess" and "invisible", the `security_ptrace_access_check()` will no
> longer be called either.
>
> Signed-off-by: Nicolas Bouchinet <nicolas.bouchinet@....gouv.fr>
> ---
>   fs/proc/base.c | 27 ++++++++++++++++++++++++---
>   1 file changed, 24 insertions(+), 3 deletions(-)
>
> diff --git a/fs/proc/base.c b/fs/proc/base.c
> index c667702dc69b8ca2531e88e12ed7a18533f294dd..fb128cb5f95fe65016fce96c75aee18c762a30f2 100644
> --- a/fs/proc/base.c
> +++ b/fs/proc/base.c
> @@ -746,9 +746,12 @@ static bool has_pid_permissions(struct proc_fs_info *fs_info,
>   				 struct task_struct *task,
>   				 enum proc_hidepid hide_pid_min)
>   {
> +	const struct cred *cred = current_cred(), *tcred;
> +	kuid_t caller_uid;
> +	kgid_t caller_gid;
>   	/*
> -	 * If 'hidpid' mount option is set force a ptrace check,
> -	 * we indicate that we are using a filesystem syscall
> +	 * If 'hidepid=ptraceable' mount option is set, force a ptrace check.
> +	 * We indicate that we are using a filesystem syscall
>   	 * by passing PTRACE_MODE_READ_FSCREDS
>   	 */
>   	if (fs_info->hide_pid == HIDEPID_NOT_PTRACEABLE)
> @@ -758,7 +761,25 @@ static bool has_pid_permissions(struct proc_fs_info *fs_info,
>   		return true;
>   	if (in_group_p(fs_info->pid_gid))
>   		return true;
> -	return ptrace_may_access(task, PTRACE_MODE_READ_FSCREDS);
> +
> +	task_lock(task);
> +	rcu_read_lock();
> +	caller_uid = cred->fsuid;
> +	caller_gid = cred->fsgid;
> +	tcred = __task_cred(task);
> +	if (uid_eq(caller_uid, tcred->euid) &&
> +	    uid_eq(caller_uid, tcred->suid) &&
> +	    uid_eq(caller_uid, tcred->uid)  &&
> +	    gid_eq(caller_gid, tcred->egid) &&
> +	    gid_eq(caller_gid, tcred->sgid) &&
> +	    gid_eq(caller_gid, tcred->gid)) {
> +		rcu_read_unlock();
> +		task_unlock(task);
> +		return true;
> +	}
> +	rcu_read_unlock();
> +	task_unlock(task);
> +	return false;
>   }
>   
>   
>
> ---
> base-commit: 884a80cc9208ce75831b2376f2b0464018d7f2c4
> change-id: 20250718-hidepid_fix-d0743d0540e7
>
> Best regards,