Re: [PATCH net-next 1/3] bpf: introduce current->pid, tgid, uid, gid, comm accessors

From	Andy Lutomirski <luto@amacapital.net>
Newsgroups	linux.kernel
Subject	Re: [PATCH net-next 1/3] bpf: introduce current->pid, tgid, uid, gid, comm accessors
Date	2015-06-13 01:50 +0200
Message-ID	<pAGRZ-44S-47@gated-at.bofh.it> (permalink)
References	(3 earlier) <pAFVU-2AR-15@gated-at.bofh.it> <pAG5A-2Mo-3@gated-at.bofh.it> <pAGyB-3E6-11@gated-at.bofh.it> <pAGyC-3E6-15@gated-at.bofh.it> <pAGIi-3SR-9@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

On Fri, Jun 12, 2015 at 4:38 PM, Alexei Starovoitov <ast@plumgrid.com> wrote:
> On 6/12/15 4:25 PM, Andy Lutomirski wrote:
>>
>> It's a dangerous tool.  Also, shouldn't the returned uid match the
>> namespace of the task that installed the probe, not the task that's
>> being probed?
>
>
> so leaking info to unprivileged apps is the concern?
> The whole thing is for root only as you know.
> The non-root is still far away. Today root needs to see the whole
> kernel. That was the goal from the beginning.
>

This is more of a correctness issue than a security issue.  ISTM using
current_user_ns() in a kprobe is asking for trouble.  It certainly
allows any unprivilege user to show any uid it wants to the probe,
which is probably not what the installer of the probe expects.

--Andy
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Thread

Re: [PATCH net-next 1/3] bpf: introduce current->pid, tgid, uid,  gid, comm accessors Alexei Starovoitov <ast@plumgrid.com> - 2015-06-13 01:30 +0200
  Re: [PATCH net-next 1/3] bpf: introduce current->pid, tgid, uid, gid,  comm accessors Andy Lutomirski <luto@amacapital.net> - 2015-06-13 01:30 +0200
    Re: [PATCH net-next 1/3] bpf: introduce current->pid, tgid, uid,  gid, comm accessors Alexei Starovoitov <ast@plumgrid.com> - 2015-06-13 01:40 +0200
      Re: [PATCH net-next 1/3] bpf: introduce current->pid, tgid, uid, gid,  comm accessors Andy Lutomirski <luto@amacapital.net> - 2015-06-13 01:50 +0200
        Re: [PATCH net-next 1/3] bpf: introduce current->pid, tgid, uid,  gid, comm accessors Alexei Starovoitov <ast@plumgrid.com> - 2015-06-13 02:00 +0200
          Re: [PATCH net-next 1/3] bpf: introduce current->pid, tgid, uid, gid,  comm accessors Andy Lutomirski <luto@amacapital.net> - 2015-06-13 02:10 +0200
            Re: [PATCH net-next 1/3] bpf: introduce current->pid, tgid, uid,  gid, comm accessors Alexei Starovoitov <ast@plumgrid.com> - 2015-06-13 02:20 +0200
              Re: [PATCH net-next 1/3] bpf: introduce current->pid, tgid, uid,  gid, comm accessors Alexei Starovoitov <ast@plumgrid.com> - 2015-06-13 02:30 +0200
              Re: [PATCH net-next 1/3] bpf: introduce current->pid, tgid, uid, gid,  comm accessors Andy Lutomirski <luto@amacapital.net> - 2015-06-13 02:30 +0200

csiph-web