Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1430399

Re: Documenting ptrace access mode checking

From Jann Horn <jann@thejh.net>
Newsgroups linux.kernel
Subject Re: Documenting ptrace access mode checking
Date 2016-06-24 08:40 +0200
Message-ID <rNsWt-4B1-11@gated-at.bofh.it> (permalink)
References <rMqtI-3ZE-17@gated-at.bofh.it> <rMBp7-2Kp-11@gated-at.bofh.it> <rMW0x-7AM-1@gated-at.bofh.it> <rMZ88-15H-77@gated-at.bofh.it> <rN7yG-6MX-45@gated-at.bofh.it>
Organization linux.* mail to news gateway

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

On Thu, Jun 23, 2016 at 09:42:09AM +0200, Michael Kerrisk (man-pages) wrote:
> Hi Jann,
> 
> Thanks for your further review. Follow-up of one point below.
> 
> On 06/23/2016 12:44 AM, Jann Horn wrote:
> >On Wed, Jun 22, 2016 at 09:21:29PM +0200, Michael Kerrisk (man-pages) wrote:
> >>On 06/21/2016 10:55 PM, Jann Horn wrote:
> >>>On Tue, Jun 21, 2016 at 11:41:16AM +0200, Michael Kerrisk (man-pages) wrote:
> 
> [...]
> 
> >>>>      The  algorithm  employed for ptrace access mode checking deter‐
> >>>>      mines whether the calling process is  allowed  to  perform  the
> >>>>      corresponding action on the target process, as follows:
> >>>>
> >>>>      1.  If the calling thread and the target thread are in the same
> >>>>          thread group, access is always allowed.
> >>>>
> >>>>      2.  If the access mode specifies PTRACE_MODE_FSCREDS, then  for
> >>>>          the  check in the next step, employ the caller's filesystem
> >>>>          user ID and group ID (see credentials(7));  otherwise  (the
> >>>>          access  mode  specifies  PTRACE_MODE_REALCREDS, so) use the
> >>>>          caller's real user ID and group ID.
> >>>
> >>>Might want to add a "for historical reasons" or so here.
> >>
> >>Can you be a little more precise about "here", and maybe tell me why
> >>you think it helps?
> >
> >I'm not sure, but it might be a good idea to add something like this at the
> >end of 2.:
> >"(Most other APIs that check one of the caller's UIDs use the effective one.
> >This API uses the real UID instead for historical reasons.)"
> >
> >In my opinion, it is inconsistent to use the real UID/GID here, the
> >effective one would be more appropriate. But since the existing code uses
> >the real UID/GID and that's not a security issue for existing users of
> >the ptrace API, this wasn't changed when I added the REALCREDS/FSCREDS
> >distinction.
> >
> >I think that for a reader, it might help to point out that in most cases,
> >when a process is the subject in an access check, its effective UID/GID
> >are used, and this is (together with kill()) an exception to that rule.
> >But you're the expert on writing documentation, if you think that that's
> >too much detail / confusing here, it probably is.
> 
> Okay -- got it now, I think. I made this text:
> 
>        2.  If the access mode specifies PTRACE_MODE_FSCREDS, then, for
>            the check in the next step, employ the caller's  filesystem
>            UID  and  GID.  (As noted in credentials(7), the filesystem
>            UID and GID almost always have the same values as the  cor‐
>            responding effective IDs.)
> 
>            Otherwise, the access mode specifies PTRACE_MODE_REALCREDS,
>            so use the caller's real UID and GID for the checks in  the
>            next  step.  (Most APIs that check the caller's UID and GID
>            use  the  effective  IDs.   For  historical  reasons,   the
>            PTRACE_MODE_REALCREDS check uses the real IDs instead.)

Thanks, that sounds good.

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Documenting ptrace access mode checking "Michael Kerrisk (man-pages)" <mtk.manpages@gmail.com> - 2016-06-21 11:50 +0200
  Re: Documenting ptrace access mode checking ebiederm@xmission.com (Eric W. Biederman) - 2016-06-21 22:10 +0200
    Re: Documenting ptrace access mode checking Kees Cook <keescook@chromium.org> - 2016-06-21 22:40 +0200
      Re: Documenting ptrace access mode checking ebiederm@xmission.com (Eric W. Biederman) - 2016-06-21 23:20 +0200
      Re: Documenting ptrace access mode checking "Michael Kerrisk (man-pages)" <mtk.manpages@gmail.com> - 2016-06-22 21:30 +0200
    Re: Documenting ptrace access mode checking "Michael Kerrisk (man-pages)" <mtk.manpages@gmail.com> - 2016-06-22 21:30 +0200
      Re: Documenting ptrace access mode checking ebiederm@xmission.com (Eric W. Biederman) - 2016-06-23 21:20 +0200
        Re: Documenting ptrace access mode checking "Michael Kerrisk (man-pages)" <mtk.manpages@gmail.com> - 2016-06-24 12:00 +0200
    Re: Documenting ptrace access mode checking Oleg Nesterov <oleg@redhat.com> - 2016-06-23 00:00 +0200
      Re: Documenting ptrace access mode checking "Michael Kerrisk (man-pages)" <mtk.manpages@gmail.com> - 2016-06-23 09:10 +0200
        Re: Documenting ptrace access mode checking ebiederm@xmission.com (Eric W. Biederman) - 2016-06-23 21:10 +0200
          Re: Documenting ptrace access mode checking "Michael Kerrisk (man-pages)" <mtk.manpages@gmail.com> - 2016-06-24 10:20 +0200
  Re: Documenting ptrace access mode checking Jann Horn <jann@thejh.net> - 2016-06-21 23:30 +0200
    Re: Documenting ptrace access mode checking "Michael Kerrisk (man-pages)" <mtk.manpages@gmail.com> - 2016-06-22 21:30 +0200
      Re: Documenting ptrace access mode checking Kees Cook <keescook@chromium.org> - 2016-06-22 23:20 +0200
        Re: Documenting ptrace access mode checking "Michael Kerrisk (man-pages)" <mtk.manpages@gmail.com> - 2016-06-23 09:10 +0200
        Re: Documenting ptrace access mode checking "Michael Kerrisk (man-pages)" <mtk.manpages@gmail.com> - 2016-06-24 10:50 +0200
          Re: Documenting ptrace access mode checking Casey Schaufler <casey@schaufler-ca.com> - 2016-06-24 17:20 +0200
            Re: Documenting ptrace access mode checking Kees Cook <keescook@chromium.org> - 2016-06-24 22:10 +0200
            Re: Documenting ptrace access mode checking "Michael Kerrisk (man-pages)" <mtk.manpages@gmail.com> - 2016-06-25 09:30 +0200
      Re: Documenting ptrace access mode checking Jann Horn <jann@thejh.net> - 2016-06-23 00:50 +0200
        Re: Documenting ptrace access mode checking "Michael Kerrisk (man-pages)" <mtk.manpages@gmail.com> - 2016-06-23 09:50 +0200
          Re: Documenting ptrace access mode checking Jann Horn <jann@thejh.net> - 2016-06-24 08:40 +0200
  Re: Documenting ptrace access mode checking Stephen Smalley <sds@tycho.nsa.gov> - 2016-06-23 20:10 +0200
    Re: Documenting ptrace access mode checking "Michael Kerrisk (man-pages)" <mtk.manpages@gmail.com> - 2016-06-24 10:40 +0200

csiph-web