lkml.org 
[lkml]   [1999]   [Mar]   [11]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
FromAndrew Morgan <>
SubjectRe: Linux 2.2.3ac1 [capabilities and /proc]
DateWed, 10 Mar 1999 22:26:04 -0800
Alan Cox wrote:
> o i386 security hole fix for ptrace. Its in the other architectures
> too. It only bites if you use capabilities. The bigger hole in
> /proc is fixed in 2.2.3

As a general rule in the capability based system the superuser should
not have special [read] access to sensitive things simply because of its
[e]uid being 0. The /proc/ filesystem makes this hard to enforce because
files like /proc/kcore are readable by uid=0.

Here is a patch to make it possible for the admin to mount /proc/ (plus
all of its sub directories and special files) with uid.gid other than
0.0. It simply propagates the already supported uid= and gid= mount
options for the top level /proc directory to the non-process-specific
files within the proc filesystem.

Cheers

Andrewdiff -urN linux-2.2.1/fs/proc/inode.c linux-caps/fs/proc/inode.c
--- linux-2.2.1/fs/proc/inode.c Fri May 8 18:10:30 1998
+++ linux-caps/fs/proc/inode.c Sun Jan 31 00:02:05 1999
@@ -267,10 +267,19 @@

inode->u.generic_ip = (void *) de;
if (de) {
- if (de->mode) {
+ if (de->mode) { /* why conditional on non-zero mode? */
+ struct inode *sbi;
+
inode->i_mode = de->mode;
- inode->i_uid = de->uid;
- inode->i_gid = de->gid;
+
+ if ((ino != PROC_ROOT_INO)
+ && (sbi = sb->s_root->d_inode)) {
+ inode->i_uid = sbi->i_uid;
+ inode->i_gid = sbi->i_gid;
+ } else {
+ inode->i_uid = de->uid;
+ inode->i_gid = de->gid;
+ }
}
if (de->size)
inode->i_size = de->size;
\
 
 \ /
  Last update: 2005-03-22 13:50    [from the cache]
©2003-2010