Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1524836

Re: [REVIEW][PATCH 2/3] exec: Don't allow ptracing an exec of an unreadable file

From ebiederm@xmission.com (Eric W. Biederman)
Newsgroups linux.kernel
Subject Re: [REVIEW][PATCH 2/3] exec: Don't allow ptracing an exec of an unreadable file
Date 2016-11-17 23:00 +0100
Message-ID <sECSS-6iy-5@gated-at.bofh.it> (permalink)
References (6 earlier) <sEyme-3v8-89@gated-at.bofh.it> <sEyvV-3yz-73@gated-at.bofh.it> <sEBN8-5Dy-15@gated-at.bofh.it> <sEC6t-5ZL-1@gated-at.bofh.it> <sECzw-6bD-7@gated-at.bofh.it>
Organization linux.* mail to news gateway

Show all headers | View raw

Willy Tarreau <w@1wt.eu> writes:

> On Thu, Nov 17, 2016 at 01:07:33PM -0800, Kees Cook wrote:
>> I'm not opposed to a sysctl for this. Regardless, I think we need to
>> embrace this idea now, though, since we'll soon end up with
>> architectures that enforce executable-only memory, in which case
>> ptrace will again fail. Almost better to get started here and then not
>> have more surprises later.
>
> Also that makes me realize that by far the largest use case of ptrace
> is strace and that strace needs very little capabilities. I guess that
> most users would be fine with having only pointers and not contents
> for addresses or read/write of data, as they have on some other OSes,
> when the process is not readable. But in my opinion when a process
> is executable we should be able to trace its execution (even without
> memory read access).

Given all of this I will respin this series with a replacement patch
that adds a permission check ion the path where ptrace calls
access_process_vm.

I avoided it because the patch is a bit larger and with full ptrace control
is much better at leaking information.  Even if you can't read the
data.  But ptrace works even if it won't give you the memory based
arguments to system calls anymore.

Eric

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[REVIEW][PATCH 0/3] Fixing ptrace vs exec vs userns interactions ebiederm@xmission.com (Eric W. Biederman) - 2016-11-17 18:10 +0100
  [REVIEW][PATCH 1/3] ptrace: Capture the ptracer's creds not PT_PTRACE_CAP ebiederm@xmission.com (Eric W. Biederman) - 2016-11-17 18:20 +0100
    Re: [REVIEW][PATCH 1/3] ptrace: Capture the ptracer's creds not PT_PTRACE_CAP Kees Cook <keescook@chromium.org> - 2016-11-18 00:20 +0100
      Re: [REVIEW][PATCH 1/3] ptrace: Capture the ptracer's creds not PT_PTRACE_CAP ebiederm@xmission.com (Eric W. Biederman) - 2016-11-18 20:00 +0100
    Re: [REVIEW][PATCH 1/3] ptrace: Capture the ptracer's creds not PT_PTRACE_CAP Andy Lutomirski <luto@amacapital.net> - 2016-11-18 00:30 +0100
      Re: [REVIEW][PATCH 1/3] ptrace: Capture the ptracer's creds not PT_PTRACE_CAP ebiederm@xmission.com (Eric W. Biederman) - 2016-11-18 00:50 +0100
  [REVIEW][PATCH 3/3] exec: Ensure mm->user_ns contains the execed files ebiederm@xmission.com (Eric W. Biederman) - 2016-11-17 18:20 +0100
  [REVIEW][PATCH 2/3] exec: Don't allow ptracing an exec of an unreadable file ebiederm@xmission.com (Eric W. Biederman) - 2016-11-17 18:20 +0100
    Re: [REVIEW][PATCH 2/3] exec: Don't allow ptracing an exec of an  unreadable file Willy Tarreau <w@1wt.eu> - 2016-11-17 21:50 +0100
      Re: [REVIEW][PATCH 2/3] exec: Don't allow ptracing an exec of an  unreadable file Kees Cook <keescook@chromium.org> - 2016-11-17 22:10 +0100
        Re: [REVIEW][PATCH 2/3] exec: Don't allow ptracing an exec of an  unreadable file Willy Tarreau <w@1wt.eu> - 2016-11-17 22:40 +0100
          Re: [REVIEW][PATCH 2/3] exec: Don't allow ptracing an exec of an unreadable file ebiederm@xmission.com (Eric W. Biederman) - 2016-11-17 23:00 +0100
            [REVIEW][PATCH 2/3] ptrace: Don't allow accessing an undumpable mm ebiederm@xmission.com (Eric W. Biederman) - 2016-11-18 00:00 +0100
              Re: [REVIEW][PATCH 2/3] ptrace: Don't allow accessing an undumpable mm Kees Cook <keescook@chromium.org> - 2016-11-18 00:20 +0100
        Re: [REVIEW][PATCH 2/3] exec: Don't allow ptracing an exec of an  unreadable file Andy Lutomirski <luto@amacapital.net> - 2016-11-18 00:30 +0100
    Re: [REVIEW][PATCH 2/3] exec: Don't allow ptracing an exec of an  unreadable file Andy Lutomirski <luto@amacapital.net> - 2016-11-18 00:40 +0100
      Re: [REVIEW][PATCH 2/3] exec: Don't allow ptracing an exec of an unreadable file ebiederm@xmission.com (Eric W. Biederman) - 2016-11-18 01:00 +0100
        Re: [REVIEW][PATCH 2/3] exec: Don't allow ptracing an exec of an  unreadable file Andy Lutomirski <luto@amacapital.net> - 2016-11-18 01:20 +0100
          Re: [REVIEW][PATCH 2/3] exec: Don't allow ptracing an exec of an unreadable file ebiederm@xmission.com (Eric W. Biederman) - 2016-11-18 01:40 +0100
  Re: [REVIEW][PATCH 0/3] Fixing ptrace vs exec vs userns interactions Willy Tarreau <w@1wt.eu> - 2016-11-19 08:20 +0100
    Re: [REVIEW][PATCH 0/3] Fixing ptrace vs exec vs userns interactions Willy Tarreau <w@1wt.eu> - 2016-11-19 10:30 +0100
      Re: [REVIEW][PATCH 0/3] Fixing ptrace vs exec vs userns interactions Willy Tarreau <w@1wt.eu> - 2016-11-19 10:40 +0100
      Re: [REVIEW][PATCH 0/3] Fixing ptrace vs exec vs userns interactions ebiederm@xmission.com (Eric W. Biederman) - 2016-11-19 19:50 +0100
    Re: [REVIEW][PATCH 0/3] Fixing ptrace vs exec vs userns interactions ebiederm@xmission.com (Eric W. Biederman) - 2016-11-19 19:40 +0100
      Re: [REVIEW][PATCH 0/3] Fixing ptrace vs exec vs userns interactions ebiederm@xmission.com (Eric W. Biederman) - 2016-11-19 19:50 +0100

csiph-web