Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1504159

Re: [REVIEW][PATCH] exec: Don't exec files the userns root can not read.

Show all headers | View raw

On Wed, Oct 19, 2016 at 11:52:50AM -0500, Eric W. Biederman wrote:
> Andy Lutomirski <luto@amacapital.net> writes:
> > Simply ptrace yourself, exec the
> > program, and then dump the program out.  A program that really wants
> > to be unreadable should have a stub: the stub is setuid and readable,
> > but all the stub does is to exec the real program, and the real
> > program should have mode 0500 or similar.
> >
> > ISTM the "right" check would be to enforce that the program's new
> > creds can read the program, but that will break backwards
> > compatibility.
> 
> Last I looked I had the impression that exec of a setuid program kills
> the ptrace.
> 
> If we are talking about a exec of a simple unreadable executable (aka
> something that sets undumpable but is not setuid or setgid).  Then I
> agree it should break the ptrace as well and since those programs are as
> rare as hens teeth I don't see any problem with changing the ptrace behavior
> in that case.

Nope. check_unsafe_exec() sets LSM_UNSAFE_* flags in bprm->unsafe, and then
the flags are checked by the LSMs and cap_bprm_set_creds() in commoncap.c.
cap_bprm_set_creds() just degrades the execution to a non-setuid-ish one,
and e.g. ptracers stay attached.

Same thing happens if the fs struct is shared with another process or if
NO_NEW_PRIVS is active.

(Actually, it's still a bit like normal setuid execution: IIRC AT_SECURE
stays active, and the resulting process still won't be dumpable, so it's
not possible for a *new* ptracer to attach afterwards. But this is just
from memory, I'm not entirely sure.)

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Re: [REVIEW][PATCH] mm: Add a user_ns owner to mm_struct and fix  ptrace_may_access Michal Hocko <mhocko@kernel.org> - 2016-10-18 16:00 +0200
  Re: [REVIEW][PATCH] mm: Add a user_ns owner to mm_struct and fix  ptrace_may_access Jann Horn <jann@thejh.net> - 2016-10-18 16:00 +0200
  Re: [REVIEW][PATCH] mm: Add a user_ns owner to mm_struct and fix ptrace_may_access ebiederm@xmission.com (Eric W. Biederman) - 2016-10-18 17:00 +0200
    Re: [REVIEW][PATCH] mm: Add a user_ns owner to mm_struct and fix  ptrace_may_access Jann Horn <jann@thejh.net> - 2016-10-18 17:10 +0200
      Re: [REVIEW][PATCH] mm: Add a user_ns owner to mm_struct and fix ptrace_may_access ebiederm@xmission.com (Eric W. Biederman) - 2016-10-18 17:40 +0200
        Re: [REVIEW][PATCH] mm: Add a user_ns owner to mm_struct and fix  ptrace_may_access Jann Horn <jann@thejh.net> - 2016-10-18 21:20 +0200
          Re: [REVIEW][PATCH] mm: Add a user_ns owner to mm_struct and fix ptrace_may_access ebiederm@xmission.com (Eric W. Biederman) - 2016-10-18 23:10 +0200
            [REVIEW][PATCH] exec: Don't exec files the userns root can not read. ebiederm@xmission.com (Eric W. Biederman) - 2016-10-18 23:20 +0200
              Re: [REVIEW][PATCH] exec: Don't exec files the userns root can not read. Amir Goldstein <amir73il@gmail.com> - 2016-10-19 08:20 +0200
                Re: [REVIEW][PATCH] exec: Don't exec files the userns root can not read. ebiederm@xmission.com (Eric W. Biederman) - 2016-10-19 17:10 +0200
                Re: [REVIEW][PATCH] exec: Don't exec files the userns root can not read. ebiederm@xmission.com (Eric W. Biederman) - 2016-10-19 19:10 +0200
              Re: [REVIEW][PATCH] exec: Don't exec files the userns root can not read. Andy Lutomirski <luto@amacapital.net> - 2016-10-19 17:40 +0200
                Re: [REVIEW][PATCH] exec: Don't exec files the userns root can not read. ebiederm@xmission.com (Eric W. Biederman) - 2016-10-19 19:00 +0200
                Re: [REVIEW][PATCH] exec: Don't exec files the userns root can not  read. Jann Horn <jann@thejh.net> - 2016-10-19 19:30 +0200
                Re: [REVIEW][PATCH] exec: Don't exec files the userns root can not read. Andy Lutomirski <luto@amacapital.net> - 2016-10-19 19:40 +0200
                Re: [REVIEW][PATCH] exec: Don't exec files the userns root can not read. ebiederm@xmission.com (Eric W. Biederman) - 2016-10-19 20:00 +0200
                Re: [REVIEW][PATCH] exec: Don't exec files the userns root can not read. Andy Lutomirski <luto@amacapital.net> - 2016-10-19 20:40 +0200
                Re: [REVIEW][PATCH] exec: Don't exec files the userns root can not read. ebiederm@xmission.com (Eric W. Biederman) - 2016-10-19 23:30 +0200
                Re: [REVIEW][PATCH] exec: Don't exec files the userns root can not read. Andy Lutomirski <luto@amacapital.net> - 2016-10-20 01:20 +0200
    Re: [REVIEW][PATCH] mm: Add a user_ns owner to mm_struct and fix  ptrace_may_access Michal Hocko <mhocko@kernel.org> - 2016-10-18 20:10 +0200

csiph-web