Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1428172

Re: Documenting ptrace access mode checking

Show all headers | View raw

Kees Cook <keescook@chromium.org> writes:

> On Tue, Jun 21, 2016 at 12:55 PM, Eric W. Biederman
> <ebiederm@xmission.com> wrote:
>
>> "Michael Kerrisk (man-pages)" <mtk.manpages@gmail.com> writes:
>>
>>>        The  algorithm  employed for ptrace access mode checking deter‐
>>>        mines whether the calling process is  allowed  to  perform  the
>>>        corresponding action on the target process, as follows:
>>>
>>>        1.  If the calling thread and the target thread are in the same
>>>            thread group, access is always allowed.
>>
>> This test only exsits because the LSMs historically and I suspect
>> continue to be broken and deny a process the ability to ptrace itself.
>
> Well, it's not that the LSMs are broken, it's that self-inspection is
> a short-circuited "allow". The LSMs aren't involved.

Long ago and far away.  I modified /proc/self/something to use the same
permissions as ptrace.  This broken everyone's selinux setups.  So the
short circuit was added.

Or in short the LSMs aren't involved because they got it wrong.

If the selinux breakage was not in the selinux rules that are loaded from
userspace but in the kernel module that short circuit check would have
been confined to selinux.

I have had an occasional thought and the occassional discussion about
removing that check and just fixing the LSMs but at this point I don't
think anyone cares enough to make that change.

Eric

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Documenting ptrace access mode checking "Michael Kerrisk (man-pages)" <mtk.manpages@gmail.com> - 2016-06-21 11:50 +0200
  Re: Documenting ptrace access mode checking ebiederm@xmission.com (Eric W. Biederman) - 2016-06-21 22:10 +0200
    Re: Documenting ptrace access mode checking Kees Cook <keescook@chromium.org> - 2016-06-21 22:40 +0200
      Re: Documenting ptrace access mode checking ebiederm@xmission.com (Eric W. Biederman) - 2016-06-21 23:20 +0200
      Re: Documenting ptrace access mode checking "Michael Kerrisk (man-pages)" <mtk.manpages@gmail.com> - 2016-06-22 21:30 +0200
    Re: Documenting ptrace access mode checking "Michael Kerrisk (man-pages)" <mtk.manpages@gmail.com> - 2016-06-22 21:30 +0200
    Re: Documenting ptrace access mode checking Oleg Nesterov <oleg@redhat.com> - 2016-06-23 00:00 +0200
      Re: Documenting ptrace access mode checking "Michael Kerrisk (man-pages)" <mtk.manpages@gmail.com> - 2016-06-23 09:10 +0200
  Re: Documenting ptrace access mode checking Jann Horn <jann@thejh.net> - 2016-06-21 23:30 +0200
    Re: Documenting ptrace access mode checking "Michael Kerrisk (man-pages)" <mtk.manpages@gmail.com> - 2016-06-22 21:30 +0200
      Re: Documenting ptrace access mode checking Kees Cook <keescook@chromium.org> - 2016-06-22 23:20 +0200
        Re: Documenting ptrace access mode checking "Michael Kerrisk (man-pages)" <mtk.manpages@gmail.com> - 2016-06-23 09:10 +0200
      Re: Documenting ptrace access mode checking Jann Horn <jann@thejh.net> - 2016-06-23 00:50 +0200
        Re: Documenting ptrace access mode checking "Michael Kerrisk (man-pages)" <mtk.manpages@gmail.com> - 2016-06-23 09:50 +0200

csiph-web