Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1514817

Re: [2/2] procfs/tasks: add a simple per-task procfs hidepid= field

Show all headers | View raw

On Thu, Nov 3, 2016 at 12:24 PM, Jann Horn <jann@thejh.net> wrote:

>> +     case PR_SET_HIDEPID:
>> +             if (arg2 < HIDEPID_OFF || arg2 > HIDEPID_INVISIBLE)
>> +                     return -EINVAL;
>> +             if (arg2 < me->hide_pid)
>> +                     return -EPERM;
>> +             me->hide_pid = arg2;
>> +             break;
>
> Should we test for ns_capable(CAP_SYS_ADMIN)||no_new_privs here?
> I think it wouldn't hurt, and I'd like to avoid adding new ways in which
> the execution of setuid programs can be influenced. OTOH, people already
> use hidepid now, and it's not an issue... I'm not sure. Opinions?

Hmm, the existing hidepid= thing is a mount option and that you you of
course can only change with root privs so far, hence the NNP thing
doesn't really apply so far on hidepid.

> @Lafcadio: Do you think that requiring no_new_privs to be set would
> break your usecase? Would nginx need to still be able to execute setuid
> binaries?

I think adding the NNP check would be OK for my use. I'll add this to
the next iteration!

> Aside from this, and the comments Kees already made, this looks good
> to me.

Thanks for the review,

L.

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 2/2] procfs/tasks: add a simple per-task procfs hidepid= field Lafcadio Wluiki <wluikil@gmail.com> - 2016-11-03 16:40 +0100
  Re: [PATCH 2/2] procfs/tasks: add a simple per-task procfs hidepid= field Kees Cook <keescook@chromium.org> - 2016-11-03 17:20 +0100
    Re: [PATCH 2/2] procfs/tasks: add a simple per-task procfs hidepid=  field Jann Horn <jann@thejh.net> - 2016-11-03 19:00 +0100
      Re: [PATCH 2/2] procfs/tasks: add a simple per-task procfs hidepid= field Kees Cook <keescook@chromium.org> - 2016-11-03 19:10 +0100
  Re: [2/2] procfs/tasks: add a simple per-task procfs hidepid= field Jann Horn <jann@thejh.net> - 2016-11-03 19:30 +0100
    Re: [2/2] procfs/tasks: add a simple per-task procfs hidepid= field Lafcadio Wluiki <wluikil@gmail.com> - 2016-11-03 21:30 +0100
    Re: [2/2] procfs/tasks: add a simple per-task procfs hidepid= field Kees Cook <keescook@chromium.org> - 2016-11-03 21:40 +0100
      Re: [kernel-hardening] Re: [2/2] procfs/tasks: add a simple per-task  procfs hidepid= field Jann Horn <jann@thejh.net> - 2016-11-03 21:50 +0100

csiph-web