Messages in this thread | | | Date | Thu, 30 Jun 2011 00:17:18 +0400 | From | Vasiliy Kulikov <> | Subject | Re: [PATCH 2/2] taskstats: restrict access to user |
| |
On Wed, Jun 29, 2011 at 06:57 +0530, Balbir Singh wrote: > On Fri, Jun 24, 2011 at 5:39 PM, Vasiliy Kulikov <segoon@openwall.com> wrote: > > + task = find_task_by_vpid(s->pid); > > + if (!task || __task_cred(task)->euid != cred->euid) {
If consider this patch for inclusion, it also needs some check for the listener root ability. __task_cred(task)->euid == 0 or smth like that. But ptrace_task_may_access_current() is better.
> > + rcu_read_unlock(); > > + continue; > > + } > > + rcu_read_unlock(); > > + > > Release the lock prior to up_read() > > > skb_next = NULL; > > if (!list_is_last(&s->list, &listeners->list)) { > > skb_next = skb_clone(skb_cur, GFP_KERNEL); > > @@ -199,14 +211,19 @@ static void fill_stats(struct task_struct *tsk, struct taskstats *stats) > > static int fill_stats_for_pid(pid_t pid, struct taskstats *stats) > > { > > struct task_struct *tsk; > > + int rc = -ESRCH; > > > > rcu_read_lock(); > > tsk = find_task_by_vpid(pid); > > + if (tsk && !ptrace_may_access(tsk, PTRACE_MODE_READ)) { > > + tsk = NULL; > > + rc = -EACCES; > > + } > > if (tsk) > > get_task_struct(tsk); > > rcu_read_unlock(); > > if (!tsk) > > - return -ESRCH; > > + return rc; > > fill_stats(tsk, stats); > > put_task_struct(tsk); > > return 0; > > @@ -224,6 +241,10 @@ static int fill_stats_for_tgid(pid_t tgid, struct taskstats *stats) > > */ > > rcu_read_lock(); > > first = find_task_by_vpid(tgid); > > + if (first && !ptrace_may_access(first, PTRACE_MODE_READ)) { > > + rc = -EACCES; > > + goto out; > > + } > > > > if (!first || !lock_task_sighand(first, &flags)) > > goto out; > > Balbir Singh
-- Vasiliy Kulikov http://www.openwall.com - bringing security into open computing environments -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |